Security
CriticalLearn now
Authlib's JWK header injection let attackers forge any JWT
A critical flaw (CVE-2026-27962) in the widely-used Python OAuth/OIDC library let a JWT supply its own verification key — a textbook token-forgery bug class, patched in 1.6.9.
SeniorStaffPrincipal
Source ↗