CVE-2026-114618

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0

Description The default JWTBearerGrant.get audiences() function returns an empty list, which leads JWTBearerGrant.verify claims() to only check for the existence of an aud claim without verifying if it matches the current authorization server. This allows an attacker with a legitimate assertion for a different service to present it to a server that shares the same signing key and uses the default grant, enabling the acquisition of an access token across a trust boundary.

Recommendations Update to version 1.9.0. Override the get audiences() function with the server's valid audience identifiers.