CVE-2026-114618 Authlib: Default JWT bearer grant accepts assertions for the wrong audience

What is CVE-2026-114618?

CVE-2026-114618 is a medium-severity vulnerability in authlib, published on 22 Oct 2026.

Official description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.

Weakness: CWE-287, CWE-1188

Which versions are affected by CVE-2026-114618?

2 open source packages ship an affected version, including authlib. It affects 1 product.

Products include Authlib Authlib.

How do I fix CVE-2026-114618?

Upgrade authlib to 1.9.0 or later.

Is CVE-2026-114618 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114618 exists.

Other vulnerabilities in authlib

• CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass Critical 9.1
• CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle High 8.3
• CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding High 8.2
• CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification High 7.7
• CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-114618, ECHO-c817-2bcc-5ece, GHSA-fch4-3c6x-j4gc, MINI-69gh-wcqm-4p32, UBUNTU-CVE-2026-114618.