Vulnerability Details CVE-2026-114618
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 13.2%
CVSS Severity
CVSS v3 Score 6.8
References
- https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf
- https://github.com/authlib/authlib/pull/945
- https://github.com/authlib/authlib/releases/tag/v1.9.0
- https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc
- https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc
Products affected by CVE-2026-114618
-
cpe:2.3:a:authlib:authlib:-
-
cpe:2.3:a:authlib:authlib:0.1
-
cpe:2.3:a:authlib:authlib:0.10
-
cpe:2.3:a:authlib:authlib:0.11
-
cpe:2.3:a:authlib:authlib:0.12
-
cpe:2.3:a:authlib:authlib:0.12.1
-
cpe:2.3:a:authlib:authlib:0.13
-
cpe:2.3:a:authlib:authlib:0.14
-
cpe:2.3:a:authlib:authlib:0.14.1
-
cpe:2.3:a:authlib:authlib:0.14.2
-
cpe:2.3:a:authlib:authlib:0.14.3
-
cpe:2.3:a:authlib:authlib:0.15
-
cpe:2.3:a:authlib:authlib:0.15.1
-
cpe:2.3:a:authlib:authlib:0.15.2
-
cpe:2.3:a:authlib:authlib:0.15.3
-
cpe:2.3:a:authlib:authlib:0.15.4
-
cpe:2.3:a:authlib:authlib:0.15.5
-
cpe:2.3:a:authlib:authlib:0.15.6
-
cpe:2.3:a:authlib:authlib:0.2
-
cpe:2.3:a:authlib:authlib:0.2.1
-
cpe:2.3:a:authlib:authlib:0.3
-
cpe:2.3:a:authlib:authlib:0.4
-
cpe:2.3:a:authlib:authlib:0.4.1
-
cpe:2.3:a:authlib:authlib:0.5
-
cpe:2.3:a:authlib:authlib:0.5.1
-
cpe:2.3:a:authlib:authlib:0.6
-
cpe:2.3:a:authlib:authlib:0.7
-
cpe:2.3:a:authlib:authlib:0.8
-
cpe:2.3:a:authlib:authlib:0.9
-
cpe:2.3:a:authlib:authlib:1.0.0
-
cpe:2.3:a:authlib:authlib:1.0.1
-
cpe:2.3:a:authlib:authlib:1.1.0
-
cpe:2.3:a:authlib:authlib:1.2.0
-
cpe:2.3:a:authlib:authlib:1.2.1
-
cpe:2.3:a:authlib:authlib:1.3.0
-
cpe:2.3:a:authlib:authlib:1.3.1
-
cpe:2.3:a:authlib:authlib:1.3.2
-
cpe:2.3:a:authlib:authlib:1.4.0
-
cpe:2.3:a:authlib:authlib:1.4.1
-
cpe:2.3:a:authlib:authlib:1.5.0
-
cpe:2.3:a:authlib:authlib:1.5.1
-
cpe:2.3:a:authlib:authlib:1.5.2
-
cpe:2.3:a:authlib:authlib:1.6.0
-
cpe:2.3:a:authlib:authlib:1.6.1
-
cpe:2.3:a:authlib:authlib:1.6.10
-
cpe:2.3:a:authlib:authlib:1.6.11
-
cpe:2.3:a:authlib:authlib:1.6.12
-
cpe:2.3:a:authlib:authlib:1.6.2
-
cpe:2.3:a:authlib:authlib:1.6.3
-
cpe:2.3:a:authlib:authlib:1.6.4
-
cpe:2.3:a:authlib:authlib:1.6.5
-
cpe:2.3:a:authlib:authlib:1.6.6
-
cpe:2.3:a:authlib:authlib:1.6.7
-
cpe:2.3:a:authlib:authlib:1.6.8
-
cpe:2.3:a:authlib:authlib:1.6.9
-
cpe:2.3:a:authlib:authlib:1.7.0
-
cpe:2.3:a:authlib:authlib:1.7.1
-
cpe:2.3:a:authlib:authlib:1.7.2