CVE-2026-114618: Authlib: Default JWT bearer grant accepts assertions for the wrong audience
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences() returns an empty list, causing JWTBearerGrant.verifyclaims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override getaudiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Authlibto a version that resolves this vulnerability.Fixed in 1.9.0
Event History
Frequently Asked Questions
Which deployments are affected?
Authlib OAuth or OpenID Connect servers using the RFC 7523 JWT bearer grant are affected if they use the default JWTBearerGrant.get_audiences() behavior and share a signing key with another service. Implementations that override get_audiences() to return the authorization server's valid audience identifiers are not affected.
What does an attacker need to exploit this issue?
The attacker needs a legitimate JWT assertion issued for a different service and a target authorization server that shares the assertion's signing key. The default grant accepts the assertion as long as it contains an aud claim, without requiring that audience to match the target server.
What is the impact of successful exploitation?
An attacker can exchange an assertion intended for another service for an access token from the target authorization server, crossing a trust boundary. The affected configuration can expose confidentiality and integrity through access obtained with that token.
What should be done if an immediate upgrade is not possible?
Override JWTBearerGrant.get_audiences() so it returns the valid audience identifiers for the current authorization server. This makes claim validation require the assertion's aud value to match the server.
How can teams determine whether they are exposed?
Review JWTBearerGrant usage to determine whether get_audiences() is overridden with the server's accepted audiences. Also identify whether the authorization server shares JWT signing keys with other services; deployments using the default method in such a key-sharing arrangement are exposed.