{"id":"ghsa-ghsa-fch4-3c6x-j4gc","seq":1708780,"kind":"advisory","title":"Authlib: Default JWT bearer grant accepts assertions for the wrong audience","url":"https://github.com/advisories/GHSA-fch4-3c6x-j4gc","permalink":"https://vulnpulse.app/items/ghsa-ghsa-fch4-3c6x-j4gc","summary":"影響: pip:authlib < 1.9.0 → 1.9.0\nSummary Authlib's default RFC 7523 JWT bearer grant leaves get_audiences() empty, so verify_claims() only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any audience can present it to a different authorization server sharing the same signing key and obtain an access token. To be completely transparent, AI tools helped surface it. However, we have independently reprodu…","severity":"medium","techs":["python"],"cves":["CVE-2026-114618"],"tags":["GHSA-fch4-3c6x-j4gc","authlib"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:39:08.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}