CERT24PYSEC-2026-4358: Authlib JWT bearer audience validation vulnerabilityLoading data…
CERT24Threat Observatory
Period

PYSEC-2026-4358: Authlib JWT bearer audience validation vulnerability

Before version 1.9.0, Authlib's default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list. As a result, verify_claims() only checks that an aud claim exists, rather than matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a different service that shares the signing key and obtain an access token. The issue is fixed in version 1.9.0.

← Back to intelligence

PYSEC-2026-4358: Authlib JWT bearer audience validation vulnerability

Before version 1.9.0, Authlib's default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list. As a result, verify_claims() only checks that an aud claim exists, rather than matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a different service that shares the signing key and obtain an access token. The issue is fixed in version 1.9.0.