CVE-2026-114615

{
  "etk_id": "ETK-2026-2789",
  "cve_id": "CVE-2026-114615",
  "display_id": "CVE-2026-114615",
  "ghsa_id": "GHSA-7vr2-2fgp-9w7p",
  "euvd_id": "EUVD-2026-108514",
  "status": "published",
  "anchor_state": "anchored",
  "title": "JWT algorithm confusion in Authlib JOSE key handling",
  "summary": "Authlib versions 1.3.1 through 1.8.0 can misclassify prefixed PEM public keys or certificates as HMAC secrets during JWT verification. An unauthenticated attacker who knows the public key may forge tokens with arbitrary identity or authorization claims when the application accepts both symmetric and asymmetric JWT algorithms and uses affected key text.",
  "mitigation": "Upgrade Authlib to version 1.9.0. Until upgraded, restrict JWT verification to the intended asymmetric algorithm and remove leading whitespace, comments, or byte-order marks from configured PEM and certificate data.",
  "vendor": "pip",
  "product": "pip:Authlib",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.3.1, <= 1.8.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.9.0"
      ],
      "package_name": "authlib",
      "purl": "pkg:pypi/authlib"
    }
  ],
  "cwes": null,
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 15.175328116666666,
  "t0_at": "2026-10-22T21:10:02.023000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-27T20:33:33.696801+00:00",
      "days": 4.974672150474537,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T21:10:02.023000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-22T21:10:02.023000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T21:10:02.023000+00:00",
      "url": "https://github.com/advisories/GHSA-7vr2-2fgp-9w7p"
    }
  }
}