Vulnerability Details CVE-2026-27962
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 20.0%
CVSS Severity
CVSS v3 Score 9.1
References
Products affected by CVE-2026-27962
-
cpe:2.3:a:authlib:authlib:-
-
cpe:2.3:a:authlib:authlib:0.1
-
cpe:2.3:a:authlib:authlib:0.10
-
cpe:2.3:a:authlib:authlib:0.11
-
cpe:2.3:a:authlib:authlib:0.12
-
cpe:2.3:a:authlib:authlib:0.12.1
-
cpe:2.3:a:authlib:authlib:0.13
-
cpe:2.3:a:authlib:authlib:0.14
-
cpe:2.3:a:authlib:authlib:0.14.1
-
cpe:2.3:a:authlib:authlib:0.14.2
-
cpe:2.3:a:authlib:authlib:0.14.3
-
cpe:2.3:a:authlib:authlib:0.15
-
cpe:2.3:a:authlib:authlib:0.15.1
-
cpe:2.3:a:authlib:authlib:0.15.2
-
cpe:2.3:a:authlib:authlib:0.15.3
-
cpe:2.3:a:authlib:authlib:0.15.4
-
cpe:2.3:a:authlib:authlib:0.15.5
-
cpe:2.3:a:authlib:authlib:0.15.6
-
cpe:2.3:a:authlib:authlib:0.2
-
cpe:2.3:a:authlib:authlib:0.2.1
-
cpe:2.3:a:authlib:authlib:0.3
-
cpe:2.3:a:authlib:authlib:0.4
-
cpe:2.3:a:authlib:authlib:0.4.1
-
cpe:2.3:a:authlib:authlib:0.5
-
cpe:2.3:a:authlib:authlib:0.5.1
-
cpe:2.3:a:authlib:authlib:0.6
-
cpe:2.3:a:authlib:authlib:0.7
-
cpe:2.3:a:authlib:authlib:0.8
-
cpe:2.3:a:authlib:authlib:0.9
-
cpe:2.3:a:authlib:authlib:1.0.0
-
cpe:2.3:a:authlib:authlib:1.0.1
-
cpe:2.3:a:authlib:authlib:1.1.0
-
cpe:2.3:a:authlib:authlib:1.2.0
-
cpe:2.3:a:authlib:authlib:1.2.1
-
cpe:2.3:a:authlib:authlib:1.3.0
-
cpe:2.3:a:authlib:authlib:1.3.1
-
cpe:2.3:a:authlib:authlib:1.3.2
-
cpe:2.3:a:authlib:authlib:1.4.0
-
cpe:2.3:a:authlib:authlib:1.4.1
-
cpe:2.3:a:authlib:authlib:1.5.0
-
cpe:2.3:a:authlib:authlib:1.5.1
-
cpe:2.3:a:authlib:authlib:1.5.2
-
cpe:2.3:a:authlib:authlib:1.6.0
-
cpe:2.3:a:authlib:authlib:1.6.1
-
cpe:2.3:a:authlib:authlib:1.6.2
-
cpe:2.3:a:authlib:authlib:1.6.3
-
cpe:2.3:a:authlib:authlib:1.6.4
-
cpe:2.3:a:authlib:authlib:1.6.5
-
cpe:2.3:a:authlib:authlib:1.6.6
-
cpe:2.3:a:authlib:authlib:1.6.7
-
cpe:2.3:a:authlib:authlib:1.6.8