Authlib EUVD-2026-108520

Exploitation requires three concrete conditions, all stated in the advisory: (1) the target authorization server uses Authlib's default authlib.oauth2.rfc7523.JWTBearerGrant and does NOT override get_audiences() with its own valid audience identifiers; (2) that server shares the same JWT signing key with another authorization server; and (3) the attacker already holds a legitimately issued JWT bearer assertion for some other audience (obtained as a low-privilege principal, hence PR:L). The limiting factors that reduce real-world risk: implementations that override get_audiences() to return the server's valid audience identifiers are explicitly NOT affected, and the two servers must share signing key material - without a shared key the forged/replayed assertion will not validate. This is NOT a default-everywhere remote-unauthenticated flaw; it is an authorization-boundary bypass specific to shared-key, default-grant deployments (notably microservice architectures sharing identity infrastructure).

This is a genuine authentication/authorization-boundary flaw (CWE-287/CWE-1188) but its real-world severity is gated by meaningful preconditions, which the CVSS 6.8 (medium) score reflects well. The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N is internally consistent with the description: AV:N (the attack is delivered to a network token endpoint), AC:H (exploitation depends on conditions outside the attacker's direct control - two authorization servers must share the same JWT signing key and the target must run the default JWTBearerGrant without overriding get_audiences()), and PR:L (the attacker must already hold a legitimately issued JWT assertion, i.e. have authenticated somewhere as a low-privilege principal). A public, detailed PoC is published in the GHSA advisory and was independently reproduced and validated by its authors (a University of Sydney research team); it is not distributed as a packaged weaponized exploit, so treat it as a working reproducer rather than drop-in attack tooling. There is NO CISA KEV listing, so this is not confirmed actively exploited, and NO EPSS score was supplied in the input, so exploitation probability cannot be quantified from the data. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-conditional authorization bypass rather than a widespread emergency. One signal worth flagging: the described impact crosses a trust boundary between two authorization servers, which could arguably justify a scope change (S:C) rather than the supplied S:U - defenders operating shared-key microservice fleets should weight this higher than the raw score suggests.

In a microservice or federated environment where several authorization servers share the same JWT signing key, an attacker legitimately obtains a JWT bearer assertion from one low-privilege service (with aud set to that service, e.g. https://evil.test/token). They replay that assertion to a second server's token endpoint; because the second server uses the default JWTBearerGrant whose get_audiences() returns an empty list, verify_claims() only confirms an aud claim is present without matching it to the local endpoint, and the server issues an access token across the trust boundary. A full reproducer PoC is published in the GHSA advisory and was reproduced by the reporting researchers.