---
id: "CVE-2026-114618"
kind: "vulnerability"
aliases: ["CVE-2026-114618"]
title: "Authlib: JWT bearer grant accepts assertions meant for other services"
severity: "medium"
cvss: 6.8
epss: 0.00225
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authlib", "oauth", "openid-connect", "package", "python"]
not_affected_if: ["no-jwt-bearer-grant", "overrides-get-audiences"]
published_at: "2026-10-22T22:18:04+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:42:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114618", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114618", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Authlib: JWT bearer grant accepts assertions meant for other services

Before version 1.9.0, Authlib's default RFC 7523 JWT bearer grant only checks that an assertion has an aud claim, without matching it to the current server. An attacker holding a valid assertion issued for another service that shares the signing key can use it to obtain an access token here.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the Authlib version with `pip show authlib` or `pip freeze | grep -i authlib`
- Check whether the server uses `JWTBearerGrant` without overriding `get_audiences()`
- Check whether the other services sharing the signing key are trusted with the same keys

## Fix

- Upgrade Authlib to `1.9.0` or later
- Until upgraded, override `get_audiences()` to return the server's valid audience identifiers

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114618
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114618

## From the sources

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_