PyJWT prior to 2.12.0 does not validate the crit header parameter defined in RFC 7515 §4.1.11. When a JWS contains a crit array listing extensions that the library does not understand, PyJWT accepts the token instead of rejecting it. This behavior violates the RFC’s MUST requirement, potentially allowing an attacker to supply malicious extensions and manipulate token validation, leading to unauthorized access or other security compromise. The weakness is categorized under CWE‑345, CWE‑347, and CWE‑863.

The vulnerability affects the PyJWT library published by jpadilla. All installed versions prior to 2.12.0 are susceptible. The product is identified by the CPE cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*.

The CVSS base score is 7.5, indicating a high severity. The EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can remotely exploit this flaw by crafting a JWS token containing unknown crit header extensions; the library will accept the token, providing a potential attack vector. Because no specific conditions or network restrictions are described in the data, remote exploitation is considered feasible but the low EPSS underlines that actual attack occurrences are presently infrequent.