The vulnerability lies in Authlib's internal hash verification logic (_verify_hash) used to validate OpenID Connect ID Token claims such as at_hash and c_hash. When this logic encounters an unsupported or unknown cryptographic algorithm, the library fails open and quietly returns True, accepting the token as valid. This flaw permits an attacker to construct a forged ID token with a deliberately unrecognized "alg" header parameter, bypassing all mandated integrity checks and violating OIDC specifications. The consequence is the ability to impersonate users or authorize actions without proper authentication, thereby granting unauthorized access to protected resources. The weakness is identified as CWE-354 and CWE-573.

Authlib, the popular Python OAuth/OpenID Connect library, is affected. All releases prior to version 1.6.9 contain the flaw; the vulnerability has been fixed in Authlib 1.6.9. Any application or service that integrates Authlib 1.6.8 or earlier and performs ID token validation is potentially vulnerable.

The CVSS score is 8.2, indicating high severity. EPSS is less than 1%, so exploitation probability is currently low. The vulnerability is not listed in the CISA KEV catalog. The likely attack path is an adversary supplying a forged ID token to an application that relies on Authlib for token validation. Because the flaw results in silent acceptance of unsupported algorithms, no further conditions such as elevated privileges or network reconnaissance are required to exploit it.