CVE-2026-27962
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability in the Authlib library (versions prior to 1.6.9) allows an attacker to inject a JWK key into the JWT header. This enables forging arbitrary JWT tokens that pass signature verification, as the library uses the attacker-supplied key instead of a trusted server key.
Risk Assessment
An attacker can completely bypass authentication and authorization mechanisms, impersonating any user or service. This can lead to unauthorized access to protected resources and data.
Recommendation
Immediately update the Authlib library to version 1.6.9 or later. If an update is not possible, ensure that JWS deserialization functions are not called with key=None.
Original NVD description (English source)
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.