CVE-2024-37568 – This vulnerability allows attackers to forge JW... (How to Fix)

📋 TL;DR

This vulnerability allows attackers to forge JWT tokens by exploiting algorithm confusion in lepture Authlib. When jwt.decode() is called without specifying an algorithm, the library incorrectly accepts HMAC verification with asymmetric public keys, enabling authentication bypass. This affects any application using vulnerable versions of lepture Authlib for JWT validation.

💻 Affected Systems

Products:

lepture Authlib

Versions: All versions before 1.3.1

Operating Systems: All operating systems running Python applications

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability occurs when jwt.decode() is called without explicit algorithm parameter. Applications using default JWT validation are vulnerable.

📦 What is this software?

Authlib by Authlib

View all CVEs affecting Authlib →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete authentication bypass allowing attackers to impersonate any user, escalate privileges, and access sensitive data or administrative functions.

🟠

Likely Case

Authentication bypass enabling unauthorized access to user accounts and protected resources.

🟢

If Mitigated

Limited impact if proper algorithm validation is enforced or if tokens are validated with proper algorithm specification.

🌐 Internet-Facing: HIGH - Any internet-facing application using vulnerable Authlib for authentication is at risk of account takeover.

🏢 Internal Only: MEDIUM - Internal applications are still vulnerable but have reduced attack surface compared to internet-facing systems.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires knowledge of public key and ability to craft JWT tokens. Similar to previously exploited vulnerabilities CVE-2022-29217 and CVE-2024-33663.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.3.1

Vendor Advisory: https://github.com/lepture/authlib/issues/654

Restart Required: Yes

Instructions:

1. Update Authlib: pip install --upgrade authlib==1.3.1
2. Restart all affected Python applications
3. Verify all JWT validation calls explicitly specify algorithms

🔧 Temporary Workarounds

Explicit Algorithm Specification

all

Modify all jwt.decode() calls to explicitly specify the expected algorithm parameter

Change jwt.decode(token, key) to jwt.decode(token, key, algorithms=['RS256']) or appropriate algorithm

🧯 If You Can't Patch

Implement application-level validation to reject tokens without proper algorithm headers
Use Web Application Firewall (WAF) rules to detect and block JWT manipulation attempts

🔍 How to Verify

Check if Vulnerable:

Check if Authlib version < 1.3.1 and if any jwt.decode() calls lack explicit algorithm parameter

Check Version:

python -c "import authlib; print(authlib.__version__)"

Verify Fix Applied:

Verify Authlib version is 1.3.1 or higher and all jwt.decode() calls include explicit algorithm parameter

📡 Detection & Monitoring

Log Indicators:

Failed JWT validations with algorithm mismatch errors
Unusual authentication patterns or successful logins with malformed tokens

Network Indicators:

HTTP requests with manipulated JWT tokens in Authorization headers
Unusual authentication attempts to JWT-protected endpoints

SIEM Query:

source="application_logs" AND ("jwt.decode" OR "JWT validation") AND ("algorithm" OR "signature") AND ("error" OR "failed")

📊 Metadata

CVE ID: CVE-2024-37568

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE: CWE-347

Published: June 9, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-37568, you might also want to check these: