---
id: CVE-2026-27962
title: Authlib is a Python library which builds OAuth and OpenID Connect servers
summary: >-
  Authlib is a Python library which builds OAuth and OpenID Connect servers.
  Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS
  implementation allows an unauthenticated attacker to forge arbitrary JWT
  tokens that…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-347
vendor: authlib
product: authlib
affected:
  - authlib < 1.6.9
patched:
  - authlib 1.6.9
published: '2026-03-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T13:18:01.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27962'
references:
  - url: >-
      https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681
    label: security-advisories@github.com
  - url: 'https://github.com/authlib/authlib/releases/tag/v1.6.9'
    label: security-advisories@github.com
  - url: 'https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5'
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:19375'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:24853'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:48085'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:5665'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:7314'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-27962'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2448164'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27962.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-27962'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27962'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-03-16T00:00:00+00:00'
epss: 0.00548
epssPercentile: 0.44792
ingestedAt: '2026-07-01T15:50:58.704Z'
---

## Overview

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.

## Affected

- `authlib < 1.6.9`

## Remediation

Upgrade past the affected range:

- `authlib 1.6.9`

## Vendor advisories

- **RHSA-2026:5665** · Red Hat · fixed in: Red Hat Quay 3.10 · released 2026-03-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:5665)
- **RHSA-2026:7314** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7314)
- **RHSA-2026:24853** · Red Hat · fixed in: Red Hat Quay 3.15 · released 2026-06-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:24853)
- **RHSA-2026:19375** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-05-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:19375)
- **RHSA-2026:48085** · Red Hat · fixed in: Red Hat Quay 3.18 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48085)