OAuth Library Vulnerability in Authlib Affects Token Validation

CVE-2026-114618

What is CVE-2026-114618?

Authlib, a popular Python library used for building OAuth and OpenID Connect servers, has a vulnerability in versions prior to 1.9.0. The issue arises from the default behavior of the JWTBearerGrant.get_audiences() method, which returns an empty list. This allows an attacker with a legitimate assertion from another service to exploit this vulnerability. They can present the assertion to a server that shares the signing key and employs the default grant. Consequently, this results in the attacker obtaining an access token without requiring the aud claim to match the current authorization server. Only implementations that override the get_audiences() method with valid audience identifiers remain unaffected. The vulnerability has been addressed in version 1.9.0.

References