I think there may be a problem in uv.lock around line 1.
Authlib 1.6.6 contains a JWK Header Injection flaw (CVE‑2026‑27962) that lets an attacker supply a malicious jwk header when key=None is used for JWS deserialization. The library then trusts the embedded public key, allowing the attacker to sign a token with a private key they control and have the server accept it as a valid JWT. This enables complete authentication bypass and can lead to privilege escalation, data leakage, or unauthorized actions. The vulnerability is rated CRITICAL because it requires no authentication and can be exploited remotely. The fix is to upgrade Authlib to version 1.6.9 or later, where the unsafe header processing was removed.
Something like this might fix it:
```diff
--- a/uv.lock
+++ b/uv.lock
@@
- "name": "authlib",
- "version": "1.6.6",
+ "name": "authlib",
+ "version": "1.6.9",
```
For reference: rule CVE-2026-27962. Rated critical.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
I think there may be a problem in
uv.lockaround line 1.Authlib 1.6.6 contains a JWK Header Injection flaw (CVE‑2026‑27962) that lets an attacker supply a malicious
jwkheader whenkey=Noneis used for JWS deserialization. The library then trusts the embedded public key, allowing the attacker to sign a token with a private key they control and have the server accept it as a valid JWT. This enables complete authentication bypass and can lead to privilege escalation, data leakage, or unauthorized actions. The vulnerability is rated CRITICAL because it requires no authentication and can be exploited remotely. The fix is to upgrade Authlib to version 1.6.9 or later, where the unsafe header processing was removed.Something like this might fix it:
For reference: rule
CVE-2026-27962. Rated critical.I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.