Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8557-1 advisory.

    Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded     in JWT headers. An attacker could possibly use this issue to forge trusted tokens, resulting in     authentication and authorization bypass. (CVE-2026-27962)

    Jay Neiva and Mauro Carrillo discovered that Authlib incorrectly handled RSA1_5 encrypted tokens. An     attacker could possibly use this issue to recover sensitive encrypted information, resulting in     information disclosure. (CVE-2026-28490)

    Jay Neiva and Mauro Carrillo discovered that Authlib did not properly reject unsupported cryptographic     algorithms when validating OpenID Connect ID tokens. An attacker could possibly use this issue to bypass     token integrity checks, resulting in authentication bypass. (CVE-2026-28498)

    Johnny Deuss discovered that Authlib did not provide cross-site request forgery protection for the OAuth     cache feature in its Starlette integration. An attacker could possibly use this issue to perform     unauthorized OAuth actions, resulting in cross-site request forgery. This issue only affected Ubuntu 24.04     LTS and Ubuntu 26.04 LTS. (CVE-2026-41425)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4579 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4579-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Emmanuel Arias     May 11, 2026                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-authlib     Version        : 0.15.4-1+deb11u2     CVE ID         : CVE-2026-27962 CVE-2026-28490 CVE-2026-28498

    Three security vulnerabilities were discovered in python-authlib, a python     library which builds OAuth and OpenID Connect servers, that can cause     authentication bypass or information leaks.

    CVE-2026-27962

      Fix authentication and authorization bypass vulnerability by embedding a       crafted public key in the jwk header field when key=None is passed to JWS       deserialization functions.

    CVE-2026-28490

      Authlib exposed distinguishable error responses between invalid PKCS#1 v1.5       padding and invalid AES-GCM tag, enabling Bleichenbacher-style attacks.

    CVE-2026-28498

      Fix OIDC ID Token validation bypass in at_hash and c_hash verification.
      _verify_hash() silently returned True when create_half_hash() received an       unknown algorithm, allowing forged ID          Tokens to pass validation.

    For Debian 11 bullseye, these problems have been fixed in version     0.15.4-1+deb11u2.

    We recommend that you upgrade your python-authlib packages.

    For the detailed security status of python-authlib please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-authlib

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0975-1 advisory.

    - CVE-2026-27962: JWS `deserialize_compact()` allows for signature bypass by accepting user-controlled     embedded JWK as       verification key (bsc#1259738).
    - CVE-2026-28490: cryptographic padding oracle in JWE RSA1_5 key management algorithm (bsc#1259736).
    - CVE-2026-28498: fail-open in behavior OIDC hash validation allows for bypass mandatory integrity     protections       (bsc#1259737).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK
    Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge
    arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization
    function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk
    header field. An attacker can sign a token with their own private key, embed the matching public key in
    the header, and have the server accept the forged token as cryptographically valid — bypassing
    authentication and authorization entirely. This issue has been patched in version 1.6.9. (CVE-2026-27962)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK     Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge     arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization     function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk     header field. An attacker can sign a token with their own private key, embed the matching public key in     the header, and have the server accept the forged token as cryptographically valid  bypassing     authentication and authorization entirely. This issue has been patched in version 1.6.9. (CVE-2026-27962)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327649	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Authlib vulnerabilities (USN-8557-1)	Nessus	Ubuntu Local Security Checks	high
314275	Debian dla-4579 : python-authlib-doc - security update	Nessus	Debian Local Security Checks	high
303588	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Authlib (SUSE-SU-2026:0975-1)	Nessus	SuSE Local Security Checks	high
438852	SCA: security update for authlib (GHSA-wvwj-cvrp-7pv5)	Tenable Cloud Security	SCA Checks	critical
438852	SCA: security update for authlib (GHSA-wvwj-cvrp-7pv5)	Tenable Self-Hosted Container Security	SCA Checks	critical
302533	Linux Distros Unpatched Vulnerability : CVE-2026-27962	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-27962

critical

Tenable Plugins

high

high

high

critical

critical

critical