Improper Verification of Cryptographic Signature in authlib - CVE-2026-27962

Vulnerability identifier: #VU124066

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-27962

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication checks.

The vulnerability exists due to improper validation of HTTP headers. A remote attacker can forge arbitrary JWT tokens that pass signature verification and bypass authentication checks. 

authlib
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
Python 3 Module
openSUSE Leap
Ubuntu
python-authlib (Ubuntu package)
python311-Authlib

Install updates from vendor's website.

authlib - update to 1.6.9
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm2, 1.3.0-1ubuntu0.1~esm2, 1.6.7-1ubuntu0.1~esm1
python311-Authlib - update to 1.3.1-150600.3.17.1

• https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5

• Multiple vulnerabilities in Authlib
• SUSE update for python-Authlib
• Ubuntu update for python-authlib