Cloudanix VulnDB

CVE-2026-114618

Medium · 6.8

CVSS

6.8

EPSS

0.4%

Published

Oct 22, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A login library used by many apps failed to properly check which service a security token was meant for, letting attackers reuse a token from one app on another when the apps shared the same security key.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
Library
Class
Authentication Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Default JWTBearerGrant.get_audiences() returns empty list so verify_claims() accepts any aud claim when the signing key is shared across trust boundaries, allowing cross-service assertion replay.

Why it matters to the business

Organizations using Authlib defaults for JWT bearer grants face unauthorized access token issuance across service boundaries until they upgrade, increasing exposure window for shared-key deployments.

How an attack unfolds

Attacker obtains a valid JWT assertion issued for a different service that shares the signing key, presents it to the vulnerable authorization server using the default grant, and receives an access token without audience validation.

How to fix it

Upgrade Authlib to version 1.9.0 or later. Implementations that override get_audiences() to return the server's valid audience identifiers are unaffected.

How to confirm the fix worked

Confirm Authlib version is 1.9.0 or newer; review custom JWTBearerGrant subclasses to ensure get_audiences() returns explicit audience values rather than relying on the default empty list.

Typical attack path

  1. Identify target authorization server using Authlib <1.9.0 with shared signing key and default JWTBearerGrant
  2. Obtain legitimate JWT assertion issued for another service
  3. Send assertion to the target server's token endpoint
  4. Receive access token valid for the target service

How to detect it

Search application and authentication logs for JWT assertions presented to token endpoints where the aud claim does not match expected server identifiers; review token issuance events from JWTBearerGrant paths.

What your security team should do

  • Upgrade all Authlib deployments to 1.9.0 immediately given the authentication bypass
  • Audit all JWTBearerGrant usages for shared signing keys across services
  • Add explicit audience validation in custom grant classes where upgrade is delayed

The record

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities