Incorrect authorization in authlib - #VU158829
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to obtain access tokens with scopes exceeding those authorized by the identity provider, potentially gaining unauthorized access to data or operations.
The vulnerability exists due to incorrect authorization in Authlib's IDJAGGrant when redeeming a signed identity assertion without enforcing its scope claim. A remote user can submit valid confidential-client credentials and a valid ID-JAG assertion to the token endpoint while requesting a broader scope to obtain an access token exceeding the identity provider's per-user authorization.
Only deployments that enable the opt-in ID-JAG draft grant are affected, and the broader scope must be permitted by both the client's registration and local application policy.