JWK Header Injection Vulnerability in Authlib Python Library

CVE-2026-27962

What is CVE-2026-27962?

The Authlib Python library, essential for building OAuth and OpenID Connect servers, has a significant vulnerability prior to version 1.6.9. This flaw allows an unauthenticated attacker to exploit the JWS implementation by injecting malicious JSON Web Key (JWK) headers. When the library's JWS deserialization methods are called with a 'key=None' argument, it erroneously trusts the embedded cryptographic key from the attacker-controlled JWT jwk header field. Consequently, an attacker could create a forged JWT token signed with their own private key, and if the public key is included in the header, the server would accept the token as valid. This exploit effectively circumvents authentication and authorization protocols, presenting a severe security threat. Users are urged to update to the patched version 1.6.9 to mitigate this risk.

References