Improper Authentication in authlib - CVE-2026-114618
Published: October 14, 2026 / Updated: October 23, 2026
Vulnerability identifier: #VU155717
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114618
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain unauthorized access tokens.
The vulnerability exists due to improper authentication through missing audience validation in Authlib's default authlib.oauth2.rfc7523.JWTBearerGrant when validating JWT bearer assertions. A remote user can submit a legitimately issued JWT assertion intended for a different audience to the authorization server's token endpoint to obtain unauthorized access tokens.
Exploitation requires the issuing and accepting authorization servers to share the same signing key.
Affected software
authlib
How to mitigate CVE-2026-114618
Install security update from vendor's website.
authlib - update to 1.9.0