GHSA-wvwj-cvrp-7pv5 · Severity: critical · Ecosystem: pip — Authlib JWS JWK Header Injection: Signature Verification Bypass
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.
Conclusion & alert: CVE-2026-27962 is rated Exploit Available (58.3/100): CVSS Critical severity, with low exploitation likelihood (EPSS 0.06%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-18 | 0.04% | 0.06% | +0.03% |
| 2 | 2026-03-17 | — | 0.04% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.1 | 3.1 | CRITICAL |
|
3.9 | 5.2 | [email protected] |
GHSA-wvwj-cvrp-7pv5 · Severity: critical · Ecosystem: pip — Authlib JWS JWK Header Injection: Signature Verification Bypass
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-27962 not yet assigned priority: Debian including 1 source packages (python-authlib), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 3, open 2. | https://security-tracker.debian.org/tracker/CVE-2026-27962 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2026-27962 |
suse
|
critical | CVE-2026-27962 severity critical: SUSE including 2 source package names (python311-Authlib-1.3.1-150600.3.17.1, python313-Authlib-1.5.2-bp160.3.1), 5 product×package rows across 5 product lines (SUSE Linux Enterprise Module for Python 3 15 SP7, SUSE Linux Enterprise Server 15 SP6-LTSS, … (5 product lines)): Fixed 5. | https://www.suse.com/security/cve/CVE-2026-27962/ |
ubuntu
|
medium | CVE-2026-27962 medium priority: Ubuntu including 1 source packages (python-authlib), 4 status rows across 4 suites (jammy, noble, questing, upstream): needs-triage 3, released 1. | https://ubuntu.com/security/CVE-2026-27962 |
| URL | Tags |
|---|---|
| https://github.com/authlib/authlib/commit/a5d4b2d4c9e46bfa11c82f85fdc2bcc0b50ae681 | Patch |
| https://github.com/authlib/authlib/releases/tag/v1.6.9 | Product Release Notes |
| https://github.com/authlib/authlib/security/advisories/GHSA-wvwj-cvrp-7pv5 | Exploit Mitigation Vendor Advisory |