CVE catalog

CVE-2026-114618

python-authlib: CVE-2026-114618

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 23, 2026

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-authlibsid1.7.2-2vulnerable
Debianpython-authlibforky1.7.2-2vulnerable
Debianpython-authlibtrixie1.6.0-1+deb13u1vulnerable
Debianpython-authlibbookworm1.2.0-1+deb12u1vulnerable
Debianpython-authlibbookworm-security1.2.0-1+deb12u2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-authlibsourcesid(unfixed)not yet assignedNot reported[1151845]
Debianpython-authlibsourceforky(unfixed)not yet assignedNot reported[1151845]
Debianpython-authlibsourcetrixie(unfixed)not yet assignedNot reported[1151845]
Debianpython-authlibsourcebookworm(unfixed)not yet assignedNot reported[1151845]

[Debian bug #1151845]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-authlib]Affected

    Source package: [python-authlib]

    Details (4)

    • 1.2.0-1+deb12u1 · all · bookworm

      Affected

      dsa · python-authlib · debian · bookworm; dsa · python-authlib · debian · 12

    • 1.2.0-1+deb12u1 · all · bookworm

      Affected

      dsa · python-authlib · debian · bookworm; dsa · python-authlib · debian · 12

    • 1.2.0-1+deb12u2 · all · bookworm-security

      Affected

      dsa · python-authlib · debian · bookworm; dsa · python-authlib · debian · 12

    • 1.2.0-1+deb12u2 · all · bookworm-security

      Affected

      dsa · python-authlib · debian · bookworm; dsa · python-authlib · debian · 12

  • [python-authlib-doc]Affected

    Source package: [python-authlib]

    Details (4)

    • 1.2.0-1+deb12u1 · all · bookworm

      Affected

      dsa · python-authlib · debian · bookworm; dsa · python-authlib · debian · 12

    • 1.2.0-1+deb12u1 · all · bookworm

      Affected

      dsa · python-authlib · debian · bookworm; dsa · python-authlib · debian · 12

    • 1.2.0-1+deb12u2 · all · bookworm-security

      Affected

      dsa · python-authlib · debian · bookworm; dsa · python-authlib · debian · 12

    • 1.2.0-1+deb12u2 · all · bookworm-security

      Affected

      dsa · python-authlib · debian · bookworm; dsa · python-authlib · debian · 12

[Debian 13 (Trixie)]

  • [python3-authlib]Affected

    Source package: [python-authlib]

    Details (2)

    • 1.6.0-1+deb13u1 · all · trixie

      Affected

      dsa · python-authlib · debian · 13

    • 1.6.0-1+deb13u1 · all · trixie

      Affected

      dsa · python-authlib · debian · 13

  • [python-authlib-doc]Affected

    Source package: [python-authlib]

    Details (2)

    • 1.6.0-1+deb13u1 · all · trixie

      Affected

      dsa · python-authlib · debian · 13

    • 1.6.0-1+deb13u1 · all · trixie

      Affected

      dsa · python-authlib · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]