Authlib: Default JWT bearer grant accepts assertions for the wrong audience

影響: pip:authlib < 1.9.0 → 1.9.0

Authlib's default RFC 7523 JWT bearer grant leaves get_audiences() empty, so verify_claims() only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any audience can present it to a different authorization server sharing the same signing key and obtain an access token. To be completely transparent, AI tools helped surface it. However, we have independently reprodu…

在 GitHub Advisory Database 阅读

2026/10/28 00:39，GitHub Advisory Database 发布了“Authlib: Default JWT bearer grant accepts assertions for the wrong audience”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-114618。