CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass
Attackers can forge JWT tokens to bypass authentication and authorization in applications using the Authlib Python library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27962?
CVE-2026-27962 is a critical authentication bypass vulnerability in authlib, published on 16 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.
Weakness: CWE-347
Which versions are affected by CVE-2026-27962?
3 open source packages ship an affected version, including authlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | All versions | 1.6.9 |
authlib PyPI | All versions | 1.6.9 |
authlib PyPI | All versions | 1.6.9 |
Products include Authlib Authlib.
How do I fix CVE-2026-27962?
Upgrade authlib to 1.6.9 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-27962 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27962 exists.
Other vulnerabilities in authlib
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
- CVE-2025-59420 Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Sources
Also known as DEBIAN-CVE-2026-27962, ECHO-e780-297e-3c37, GHSA-wvwj-cvrp-7pv5, MINI-59xw-6ffh-rr9c, MINI-hcvv-cw5v-gmjm, PYSEC-2026-287 and 2 more.