Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC
    7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to
    require only that an aud claim exists without matching the current authorization server. An attacker
    holding a legitimate assertion for another service can present it to a server that shares the signing key
    and uses the default grant, obtaining an access token across a trust boundary. Implementations that
    override get_audiences() with the server's valid audience identifiers are not affected. This issue is
    fixed in version 1.9.0. (CVE-2026-114618)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC     7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to     require only that an aud claim exists without matching the current authorization server. An attacker     holding a legitimate assertion for another service can present it to a server that shares the signing key     and uses the default grant, obtaining an access token across a trust boundary. Implementations that     override get_audiences() with the server's valid audience identifiers are not affected. This issue is     fixed in version 1.9.0. (CVE-2026-114618)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477599	SCA: security update for authlib (GHSA-fch4-3c6x-j4gc)	Tenable Cloud Security	SCA Checks	Local	medium
477599	SCA: security update for authlib (GHSA-fch4-3c6x-j4gc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
371312	Linux Distros Unpatched Vulnerability : CVE-2026-114618	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-114618

medium

Tenable Plugins

medium

medium

medium