{"id":"CVE-2026-27962","title":"Authlib is a Python library which builds OAuth and OpenID Connect servers","summary":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-347"],"vendor":"authlib","product":"authlib","affected":["authlib < 1.6.9"],"patched":["authlib 1.6.9"],"published":"2026-03-16","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:18:01.463","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27962","references":[{"url":"https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681","label":"security-advisories@github.com"},{"url":"https://github.com/authlib/authlib/releases/tag/v1.6.9","label":"security-advisories@github.com"},{"url":"https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:19375","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24853","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:48085","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:5665","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7314","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-27962","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448164","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27962.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27962"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27962"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-03-16T00:00:00+00:00"},"epss":0.00548,"epssPercentile":0.44539,"ingestedAt":"2026-07-01T15:50:58.704Z","slug":"CVE-2026-27962","body":"## Overview\n\nAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.\n\n## Affected\n\n- `authlib < 1.6.9`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `authlib 1.6.9`\n\n## Vendor advisories\n\n- **RHSA-2026:5665** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-03-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:5665)\n- **RHSA-2026:7314** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7314)\n- **RHSA-2026:24853** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24853)\n- **RHSA-2026:19375** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19375)\n- **RHSA-2026:48085** · Red Hat · fixed in: Red Hat Quay 3.18 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48085)","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201488,"id":"CVE-2026-27962","ts":1789399510587,"field":"exploit_available","old":"false","new":"true"},{"seq":200222,"id":"CVE-2026-27962","ts":1789397085946,"field":"exploit_available","old":"true","new":"false"},{"seq":198146,"id":"CVE-2026-27962","ts":1789391733448,"field":"exploit_available","old":"false","new":"true"},{"seq":195939,"id":"CVE-2026-27962","ts":1789383399074,"field":"exploit_available","old":"true","new":"false"},{"seq":194868,"id":"CVE-2026-27962","ts":1789380300108,"field":"exploit_available","old":"false","new":"true"},{"seq":193655,"id":"CVE-2026-27962","ts":1789378268600,"field":"exploit_available","old":"true","new":"false"},{"seq":192442,"id":"CVE-2026-27962","ts":1789376232991,"field":"exploit_available","old":"false","new":"true"},{"seq":191229,"id":"CVE-2026-27962","ts":1789373126253,"field":"exploit_available","old":"true","new":"false"},{"seq":190014,"id":"CVE-2026-27962","ts":1789369120700,"field":"exploit_available","old":"false","new":"true"},{"seq":188801,"id":"CVE-2026-27962","ts":1789368038036,"field":"exploit_available","old":"true","new":"false"},{"seq":187584,"id":"CVE-2026-27962","ts":1789364994981,"field":"exploit_available","old":"false","new":"true"},{"seq":186371,"id":"CVE-2026-27962","ts":1789363002062,"field":"exploit_available","old":"true","new":"false"},{"seq":185157,"id":"CVE-2026-27962","ts":1789360966858,"field":"exploit_available","old":"false","new":"true"},{"seq":183944,"id":"CVE-2026-27962","ts":1789357943063,"field":"exploit_available","old":"true","new":"false"},{"seq":182196,"id":"CVE-2026-27962","ts":1789354094203,"field":"exploit_available","old":"false","new":"true"},{"seq":180989,"id":"CVE-2026-27962","ts":1789352942129,"field":"exploit_available","old":"true","new":"false"},{"seq":179782,"id":"CVE-2026-27962","ts":1789349994746,"field":"exploit_available","old":"false","new":"true"},{"seq":178575,"id":"CVE-2026-27962","ts":1789347810873,"field":"exploit_available","old":"true","new":"false"},{"seq":177368,"id":"CVE-2026-27962","ts":1789346176465,"field":"exploit_available","old":"false","new":"true"},{"seq":176161,"id":"CVE-2026-27962","ts":1789342750874,"field":"exploit_available","old":"true","new":"false"},{"seq":175945,"id":"CVE-2026-27962","ts":1789342357404,"field":"exploit_available","old":"false","new":"true"},{"seq":175485,"id":"CVE-2026-27962","ts":1789338388673,"field":"exploit_available","old":"true","new":"false"},{"seq":174280,"id":"CVE-2026-27962","ts":1789334598349,"field":"exploit_available","old":"false","new":"true"},{"seq":173075,"id":"CVE-2026-27962","ts":1789333197131,"field":"exploit_available","old":"true","new":"false"},{"seq":171889,"id":"CVE-2026-27962","ts":1789330879230,"field":"exploit_available","old":"false","new":"true"},{"seq":170703,"id":"CVE-2026-27962","ts":1789328397139,"field":"exploit_available","old":"true","new":"false"},{"seq":169498,"id":"CVE-2026-27962","ts":1789326904325,"field":"exploit_available","old":"false","new":"true"},{"seq":168293,"id":"CVE-2026-27962","ts":1789323441449,"field":"exploit_available","old":"true","new":"false"},{"seq":167088,"id":"CVE-2026-27962","ts":1789319371935,"field":"exploit_available","old":"false","new":"true"},{"seq":165883,"id":"CVE-2026-27962","ts":1789318280866,"field":"exploit_available","old":"true","new":"false"},{"seq":164678,"id":"CVE-2026-27962","ts":1789315539653,"field":"exploit_available","old":"false","new":"true"},{"seq":163473,"id":"CVE-2026-27962","ts":1789313261654,"field":"exploit_available","old":"true","new":"false"},{"seq":162268,"id":"CVE-2026-27962","ts":1789311710974,"field":"exploit_available","old":"false","new":"true"},{"seq":161063,"id":"CVE-2026-27962","ts":1789308263297,"field":"exploit_available","old":"true","new":"false"},{"seq":160568,"id":"CVE-2026-27962","ts":1789304190334,"field":"exploit_available","old":"false","new":"true"},{"seq":158406,"id":"CVE-2026-27962","ts":1789299283174,"field":"exploit_available","old":"true","new":"false"},{"seq":157370,"id":"CVE-2026-27962","ts":1789296463338,"field":"exploit_available","old":"false","new":"true"},{"seq":156165,"id":"CVE-2026-27962","ts":1789294384416,"field":"exploit_available","old":"true","new":"false"},{"seq":154960,"id":"CVE-2026-27962","ts":1789292638277,"field":"exploit_available","old":"false","new":"true"},{"seq":153755,"id":"CVE-2026-27962","ts":1789289347941,"field":"exploit_available","old":"true","new":"false"},{"seq":152967,"id":"CVE-2026-27962","ts":1789285258650,"field":"exploit_available","old":"false","new":"true"},{"seq":152211,"id":"CVE-2026-27962","ts":1789280964758,"field":"exploit_available","old":"true","new":"false"},{"seq":151172,"id":"CVE-2026-27962","ts":1789277460096,"field":"exploit_available","old":"false","new":"true"},{"seq":147901,"id":"CVE-2026-27962","ts":1789270880259,"field":"exploit_available","old":"true","new":"false"},{"seq":145941,"id":"CVE-2026-27962","ts":1789269174078,"field":"exploit_available","old":"false","new":"true"},{"seq":144844,"id":"CVE-2026-27962","ts":1789266105395,"field":"exploit_available","old":"true","new":"false"},{"seq":143748,"id":"CVE-2026-27962","ts":1789262440391,"field":"exploit_available","old":"false","new":"true"},{"seq":142584,"id":"CVE-2026-27962","ts":1789261191116,"field":"exploit_available","old":"true","new":"false"},{"seq":141420,"id":"CVE-2026-27962","ts":1789258612095,"field":"exploit_available","old":"false","new":"true"},{"seq":140222,"id":"CVE-2026-27962","ts":1789256402310,"field":"exploit_available","old":"true","new":"false"}]}