Technical impact
JWTClaimsRegistry performs membership matching on list‑valued issuer and subject claims, allowing attackers to create an array containing the legitimate issuer. This bypasses intended equality checks and permits tokens with forged issuer claims to be accepted. The resulting flaw is an authorization bypass that can lead to unauthorized access when the library is used for token validation. The weakness is reflected in CWE‑290, CWE‑345, and CWE‑480, indicating improper authorization handling, insufficient validation, and a concurrency-related issue.
Affected Systems
Packages affected are versions of the Authlib joserfc library released before 1.7.3. The vulnerability exists whenever the library is deployed in a Python application that processes JSON Web Tokens for authentication or authorization. No specific platform constraints are indicated, so the issue applies to any environment where joserfc 1.7.2 or older is present.
Risk and Exploitability
The CVSS score of 6.5 denotes moderate severity. EPSS score is <1% (approximately 0.00091), indicating a very low but nonzero probability of exploitation, making the likelihood of exploitation in the wild unclear. The vulnerability is not listed in the CISA KEV catalog, suggesting limited or documented exploitation. Attackers can likely trigger the bug by supplying a crafted JWT token over a network interface or API endpoint that uses joserfc for validation. Because the flaw enables illegal issuer recognition, the impact can be critical if the token grants privileged access.
