Threats tagged 'pysec-2026-4358'

Authlib versions prior to 1.9.0 have a vulnerability in the default implementation of JWTBearerGrant.get_audiences() where it returns an empty list. This causes the verify_claims() method to only check for the presence of an aud claim without verifying it matches the current authorization server. As a result, an attacker with a valid assertion for another service sharing the signing key can obtain an access token from the vulnerable server. This issue is fixed in Authlib version 1.9.0.