Review reviewCritical

CVE-2026-27962

authlib authlib, Red Hat Quay 3.1, Red Hat Quay 3.14

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptograp...

CVSS: 9.1
EPSS: 0.55%
CISA KEV: Not listed
Published: 2026.03.17

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.55%

Technical severityCVSS 9.1

Vulnerability overview

Affected product and versions

Product: authlib authlib, Red Hat Quay 3.1, Red Hat Quay 3.14
Affected versions: >= < 1.6.9, < 1.6.9
Fixed versions: 1.6.9

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that authlib authlib, Red Hat Quay 3.1, Red Hat Quay 3.14 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-347