Critical Authlib Flaws Expose Web Apps to Token Forgery and CSRF
Multiple high-severity vulnerabilities found in Authlib could allow attackers to bypass authentication and perform unauthorized actions. These flaws impact JWT validation, token encryption, and OAuth integrations.
TL;DR
- Authlib contains four high-risk vulnerabilities affecting JWT handling and OAuth flows.
- Attackers can forge trusted tokens, leading to authentication and authorization bypass.
- Sensitive encrypted data may be recovered due to improper RSA1_5 token handling.
- Unsupported crypto algorithms are not rejected, enabling token integrity bypass.
- Ubuntu 24.04 and 26.04 LTS users face additional CSRF risk in Starlette integration.
Security researchers have uncovered multiple serious vulnerabilities in Authlib, a widely used authentication library for Python applications. These flaws affect core functionalities such as JWT validation and OAuth integrations, potentially allowing attackers to bypass authentication mechanisms and access protected resources.
Organizations using Authlib should take immediate action to mitigate these risks. The vulnerabilities span across different aspects of token handling and cryptographic validation, making them particularly dangerous for identity-aware applications.
The issues were identified by Jay Neiva, Mauro Carrillo, and Johnny Deuss, and affect various versions of Ubuntu, with specific emphasis on Ubuntu 24.04 LTS and 26.04 LTS for one of the flaws.
JWT and Token Validation Issues
- CVE-2026-27962 allows attackers to forge trusted JWTs by exploiting improper key validation in headers.
- CVE-2026-28498 enables bypass of token integrity checks through unsupported cryptographic algorithm acceptance.
- These flaws can lead to full authentication and authorization bypass in affected systems.
Encryption Weakness and CSRF Risk
- CVE-2026-28490 affects RSA1_5 encrypted tokens, potentially allowing recovery of sensitive information.
- CVE-2026-41425 introduces CSRF vulnerability in Authlib's Starlette OAuth cache feature.
- The CSRF flaw specifically impacts Ubuntu 24.04 LTS and 26.04 LTS environments.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.