Threats tagged 'ghsa-wvwj-cvrp-7pv5'

Authlib's JWS implementation has a vulnerability (CVE-2026-27962) where passing key=None to JWS deserialization functions causes the library to trust an attacker-controlled 'jwk' header for signature verification. This allows an attacker to forge JWT tokens that pass signature checks, bypassing authentication and authorization. The issue violates RFC 7515 specifications which prohibit using keys embedded in tokens for verification. The vulnerability affects authlib versions prior to 1.6.9 and is fixed in version 1.6.9.