Log in Start free

Vulnerability · Published Mar 16, 2026 · Assigned by GitHub_M

CVE-2026-27962Authlib JWS JWK Header Injection: Signature Verification Bypass

Critical 9.1

In plain English

A critical-severity security flaw in authlib from authlib. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-authlib1.2.0-1+deb12u2DEBIAN-CVE-2026-27962
Debian:13python-authlibno fix listedDEBIAN-CVE-2026-27962
Debian:14python-authlib1.6.9-1DEBIAN-CVE-2026-27962
PyPIauthlib1.6.9PYSEC-2026-287
PyPIauthlib1.6.9GHSA-wvwj-cvrp-7pv5
Ubuntu:25.10python-authlibno fix listedUBUNTU-CVE-2026-27962
Ubuntu:26.10python-authlibno fix listedUBUNTU-CVE-2026-27962

Affected products (as reported)

VendorProductVersions
authlib authlib < 1.6.9

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References