Skip to content
Fencer Vulns
critical 9.1

CVE-2026-27962 json

Authlib JWS JWK Header Injection: Signature Verification Bypass

published 2026-03-16 7 mo ago modified 2026-10-27 12 d ago also EUVD-2026-12478 , GHSA-wvwj-cvrp-7pv5 , PYSEC-2026-287

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.

Patch / fix

  • pypi authlib 1.6.9
  • Red Hat Red Hat Quay 3.10 1773971077
  • Red Hat Red Hat Quay 3.14 1775512163
  • Red Hat Red Hat Quay 3.15 1780891395
  • Red Hat Red Hat Quay 3.16 1779204086
  • Red Hat Red Hat Quay 3.18 1784987273
  • python-authlib Debian 12 1.2.0-1+deb12u2
  • python-authlib Debian 14 1.6.9-1

debian advisories DEBIAN-CVE-2026-27962

  • python-authlib Ubuntu Pro 22.04 LTS 0.15.5-1ubuntu0.1~esm2
  • python-authlib Ubuntu Pro 24.04 LTS 1.3.0-1ubuntu0.1~esm2
  • python-authlib Ubuntu Pro 26.04 LTS 1.6.7-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-27962

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-Authlib SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Python 3 15 SP7 +1 more 1.3.1-150600.3.17.1

suse advisories SUSE-SU-2026:0975-1

  • python-Authlib openSUSE Leap 16.0 1.5.2-bp160.3.1

opensuse advisories openSUSE-SU-2026:20392-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-27962 updated cvss 9.1

authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability

  • Red Hat Quay 3.10 quay 1773971077
    fixed: vendor fix RHSA-2026:5665
  • Red Hat Quay 3.14 quay 1775512163
    fixed: vendor fix RHSA-2026:7314
  • Red Hat Quay 3.15 quay/quay-rhel8 1780891395
    fixed: vendor fix RHSA-2026:24853
  • Red Hat Quay 3.16 quay 1779204086
    fixed: vendor fix RHSA-2026:19375
  • Red Hat Quay 3.18 quay/quay-rhel9 1784987273
    fixed: vendor fix RHSA-2026:48085
  • Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/lightspeed-chatbot-rhel8, ansible-automation-platform-26/lightspeed-chatbot-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9, rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9, +13 more Red Hat Quay 3.10 quay 1772725047, quay 1772726823, quay 1772739218, quay 1774021695, quay 1774021704, quay 1774021722, +3 more Red Hat Quay 3.14 quay 1775224758, quay 1775224767, quay 1775224786, quay 1775224837, quay 1775236401, quay 1775242297, +3 more Red Hat Quay 3.15 quay/clair-rhel8 1780584775, quay/quay-builder-rhel8 1780584626, quay/quay-operator-rhel8 1780584287, quay/quay-operator-bundle 1780894591, quay/quay-bridge-operator-rhel8 1780584376, quay/quay-bridge-operator-bundle 1780585598, +3 more
    +2 more products
    Red Hat Quay 3.16 quay 1778704509, quay 1778704515, quay 1778704550, quay 1778704556, quay 1778705015, quay 1778705065, +3 more Red Hat Quay 3.18 quay/clair-rhel9 1784986949, quay/quay-builder-rhel9 1784986989, quay/quay-operator-rhel9 1784986977, quay/quay-operator-bundle 1785155359, quay/quay-bridge-operator-rhel9 1784987002, quay/quay-bridge-operator-bundle 1785239883, +3 more
    not affected: vulnerable code not present
  • Red Hat Satellite 6 satellite/foreman-mcp-server-rhel9
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
7 mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi authlib
<1.6.9
1.6.9

Affected products

  • authlib authlib
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.14
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.18
  • Red Hat Lightspeed Core
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat Satellite 6

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.