Detections
Analytics

SCA: security update for authlib (GHSA-7vr2-2fgp-9w7p)

high Tenable Cloud Security Plugin ID 477591

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0,
 OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept
 leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm
 registry and already configure verification with PEM or certificate bytes containing such a prefix, an
 unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge
 HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for
 CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in
 authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key
 material. This issue is fixed in version 1.9.0. (CVE-2026-114615)

Solution

Update the authlib library and its related packages to version 1.9.0 or later.

See Also

https://github.com/advisories/GHSA-7vr2-2fgp-9w7p

Plugin Details

Severity: High

ID: 477591

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 10/27/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-114615

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 10/22/2026

Reference Information

CVE: CVE-2026-114615