PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's
    PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature
    is false. If an application reuses that same mapping for a later decode() or decode_complete() call and
    changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-
    at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then
    be accepted without disabling signature verification, but applications that create a fresh options mapping
    for each call are not affected. (CVE-2026-103001)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's     PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature     is false. If an application reuses that same mapping for a later decode() or decode_complete() call and     changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-     at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then     be accepted without disabling signature verification, but applications that create a fresh options mapping     for each call are not affected. (CVE-2026-103001)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474337	Echo: pyjwt: security update to 2.13.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474337	Echo: pyjwt: security update to 2.13.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
465505	Chainguard: authentik-fips-2026.5: security update to 2026.5.7-r7	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
465505	Chainguard: authentik-fips-2026.5: security update to 2026.5.7-r7	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
359494	Linux Distros Unpatched Vulnerability : CVE-2026-103001	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-103001

medium

Tenable Plugins

medium

medium

medium

medium

medium