Authlib: Default JWT bearer grant accepts assertions for the wrong audience

影響: pip:authlib < 1.9.0 → 1.9.0

Authlib's default RFC 7523 JWT bearer grant leaves get_audiences() empty, so verify_claims() only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any audience can present it to a different authorization server sharing the same signing key and obtain an access token. To be completely transparent, AI tools helped surface it. However, we have independently reprodu…

Read on GitHub Advisory Database

On 10/28/2026, 12:39 AM, GitHub Advisory Database published "Authlib: Default JWT bearer grant accepts assertions for the wrong audience" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-114618.