Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in the Authlib Python library, which is used for building OAuth and Open ID Connect servers. The issue allows an unauthenticated attacker to forge security tokens, potentially leading to unauthorized access or claims. The main concern is confirming relevance and exposure to this type of authentication infrastructure.
- Security flaw allows attackers to forge tokens.
- Critical vulnerability in common authentication servers.
- Confirm if your authentication infrastructure is affected.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could forge secure tokens if a server uses a vulnerable version of the Authlib library. This is possible when the library is configured to accept PEM-formatted keys and the attacker knows the specific public key bytes used by the server. By providing these known public key bytes as an HMAC secret, the attacker can bypass security checks and create tokens with any desired claims.
- Publicly accessible authentication endpoint required.
- Attacker provides known public key bytes as secret.
- Forged tokens can grant unauthorized access.
Live Threat
Current exploitation, exposure, and threat context
An unauthenticated attacker could forge authentication tokens with arbitrary claims by exploiting how Authlib processes asymmetric keys. This is possible when using mixed algorithms with PEM or certificate bytes that contain leading whitespace, comments, or a byte-order mark, and when verification is configured with such prefixed keys. This bypasses a previous security fix.
- Forged tokens with arbitrary claims.
- Using public-key bytes as HMAC secrets.
- Unauthorized access or identity claims.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Platform or Application Security teams are likely responsible for addressing this vulnerability, given Authlib's role in building OAuth and OpenID Connect servers. The first step is to identify all deployments of Authlib, confirm their reachability and criticality, and locate the accountable owner before planning remediation.
- Ownership: Platform or Application Security teams.
- Verify first: Asset inventory and exposure.
- Action: Coordinate vendor updates or temporary risk reduction.
