Incomplete List of Disallowed Inputs in authlib - #VU163015
Published: November 9, 2026
Vulnerability identifier: #VU163015
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-184
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to forge JWTs containing arbitrary claims.
The vulnerability exists due to incomplete public-key rejection in authlib's JOSE component, which accepts tab-separated OpenSSH public keys and OpenSSH certificates as HMAC secrets. An unauthenticated remote attacker who knows the public key can sign accepted HS256 tokens when an application passes that key to jwt.decode or JsonWebSignature without restricting algorithms.
Affected software
authlib
Remediation
Install security update from vendor's website.
authlib - update to 1.9.5