SB2026110353 - Incorrect authorization in authlib

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110353

SB2026110353 - Incorrect authorization in authlib

Published: November 3, 2026

Security Bulletin ID SB2026110353
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain access tokens with scopes exceeding those authorized by the identity provider, potentially gaining unauthorized access to data or operations.

The vulnerability exists due to incorrect authorization in Authlib's IDJAGGrant when redeeming a signed identity assertion without enforcing its scope claim. A remote user can submit valid confidential-client credentials and a valid ID-JAG assertion to the token endpoint while requesting a broader scope to obtain an access token exceeding the identity provider's per-user authorization.

Only deployments that enable the opt-in ID-JAG draft grant are affected, and the broader scope must be permitted by both the client's registration and local application policy.


Remediation

Install update from vendor's website.

References