CVE-2026-27962 | BDVDB-2026-320796 Detail

Description#

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-16Record published in the CVE List.
2. Version 22026-09-10Most recent update recorded in the CVE List.