9.1
Critical
CVE-2026-27962 Authlib is a Python library which builds OAuth and OpenID Connect servers
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Quay 3.14 1775512163 | earliest → < 1775512163 | 1775512163 |
| Red Hat Quay 3.15 1780891395 | earliest → < 1780891395 | 1780891395 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.1 1773971077 | earliest → < 1773971077 | 1773971077 |
| Lightspeed Core | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| authlib 1.6 | earliest → < 1.6.9 | 1.6.9 |
Show the 2 other branches Hide the 2 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Quay 3.10 1773971077 | earliest → < 1773971077 | 1773971077 |
| Red Hat Quay 3.18 1784987273 | earliest → < 1784987273 | 1784987273 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Quay 3.14
The 28 CVEs of Red Hat Quay 3.14 →
CVE-2026-18255
A flaw was found in Quay
7.2
High
CVE-2026-15927
A flaw was found in Red Hat Quay's repository-level mirror configuration
feature
6.8
Medium
CVE-2026-42039
Axios is a promise based HTTP client for the browser and Node.js
6.9
Medium
CVE-2026-42041
Axios is a promise based HTTP client for the browser and Node.js
4.8
Medium