Authlib: Default JWT bearer grant accepts assertions for the wrong audience

影響: pip:authlib < 1.9.0 → 1.9.0

Authlib's default RFC 7523 JWT bearer grant leaves get_audiences() empty, so verify_claims() only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any audience can present it to a different authorization server sharing the same signing key and obtain an access token. To be completely transparent, AI tools helped surface it. However, we have independently reprodu…

GitHub Advisory Databaseで読む

2026/10/28 00:39、GitHub Advisory Databaseが「Authlib: Default JWT bearer grant accepts assertions for the wrong audience」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-114618。