CVE-2026-27962Critical· 9.1▾ AbyssalPoC availableAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
Exploit / PoC code exists
0.5% → 0.6%
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.
authlib < 1.6.9Upgrade past the affected range:
authlib 1.6.9Affected packages:
authlib <= 1.6.8Patched in:
authlib 1.6.9Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-28802Critical· 9.8Authlib is a Python library which builds OAuth and OpenID Connect servers
CVE-2026-96760Critical· 9.8Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability
CVE-2026-114616High· 7.4Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
CVE-2026-114620Medium· 5.4Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
CVE-2026-114618Medium· 6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audience