CVE-2026-27962 Details
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.
A JWK Header Injection vulnerability has been identified in Authlib, a Python library for building OAuth and OpenID Connect servers, prior to version 1.6.9. This vulnerability allows an unauthenticated attacker to forge JWT tokens that successfully pass signature verification. The issue arises when 'key=None' is passed to any JWS deserialization function, prompting the library to extract and use the cryptographic key from the attacker-controlled JWT 'jwk' header. By signing a token with their private key and embedding the corresponding public key in the header, an attacker can have the server accept the forged token as valid, thereby bypassing authentication and authorization. This vulnerability violates RFC 7515 by improperly using the 'jwk' header for key verification.
Users can update to Authlib version 1.6.9, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:19375 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:24853 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:48085 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:5665 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:7314 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-27962 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2448164 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27962.json | redhat-SADP | |
| https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681 | [email protected] | Patch |
| https://github.com/authlib/authlib/releases/tag/v1.6.9 | [email protected] | ProductRelease Notes |
| https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | redhat-SADP |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| authlib authlib | < 1.6.9 |
CPE
Remediation
| |
Change History
13 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 10, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 1, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Mar 17, 2026 | Initial Analysis | [email protected] |
| Mar 16, 2026 | New CVE Received | [email protected] |