Authlib: Default JWT bearer grant accepts assertions for the wrong audience

影響: pip:authlib < 1.9.0 → 1.9.0

Authlib's default RFC 7523 JWT bearer grant leaves get_audiences() empty, so verify_claims() only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any audience can present it to a different authorization server sharing the same signing key and obtain an access token. To be completely transparent, AI tools helped surface it. However, we have independently reprodu…

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 12:39, GitHub Advisory Database에서 "Authlib: Default JWT bearer grant accepts assertions for the wrong audience"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-114618.