authlib

Records31All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

authlib records in CISA KEV

No authlib vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Authlib 19 records HIGH

Records

31 records

TI-2026-65772 CVE-2026-104056 · GHSA-8wx9-759m-hfm8

Insufficient verification of data authenticity in Authlib

HIGH 82

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.002 Published 2026-10-01 Fix deferred CWE-345

TI-2026-74876 CVE-2026-102946

Signature verification bypass in joserfc JWS deserialization

HIGH 80

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00117 Published 2026-10-15 Partial fix · 1.7.4 CWE-290

TI-2026-22305 CVE-2026-27962 · GHSA-wvwj-cvrp-7pv5

Authlib JWS JWK Header Injection: Signature Verification Bypass

HIGH 80

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0057 Published 2026-03-16 Fixed in 1.6.9 CWE-347

TI-2025-40202 CVE-2025-65015 · GHSA-frfh-8v73-gjg4

Resource allocation without limits in authlib joserfc

HIGH 79

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0044 Published 2025-11-18 Fixed in 1.3.5, 1.4.2 CWE-770

TI-2026-36756 CVE-2026-49852 · GHSA-gg9x-qcx2-xmrh

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

HIGH 77

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00171 Published 2026-07-17 Fixed in 1.6.8 CWE-1391

TI-2026-79518 CVE-2026-114615 · GHSA-7vr2-2fgp-9w7p

Authlib fix bypass lets attackers forge HS256 tokens with PEM keys

HIGH 74

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00213 Published 2026-10-22 Partial fix · 1.9.0 CWE-184

TI-2026-82772 CVE-2026-119283 · GHSA-jpxq-7h8p-2q76

Uncontrolled resource consumption in authlib joserfc

HIGH 72

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00229 Published 2026-10-29 Partial fix · 1.7.5 CWE-400

TI-2026-22276 CVE-2026-27932 · GHSA-w5r5-m38g-f9f9

joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

HIGH 72

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00462 Published 2026-03-03 Fixed in 1.6.3 CWE-770

TI-2025-36973 CVE-2025-59420 · GHSA-9ggr-2464-2j32

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

HIGH 72

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00275 Published 2025-09-22 Fixed in 1.6.4 CWE-345

TI-2024-25068 CVE-2024-37568 · GHSA-5357-c2jx-v7qh

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.

HIGH 72

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00388 Published 2024-06-09 Fixed in 1.3.1 CWE-284

TI-2025-41738 CVE-2025-68158 · GHSA-fg6f-75jq-6523

Authlib: 1-click Account Takeover

HIGH 71

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00272 Published 2026-01-08 Partial fix · 1.6.6 CWE-352

TI-2026-82780 CVE-2026-119284 · GHSA-9pg5-8c7x-5hfx

Compact JWS parsing in joserfc allocates memory before size check

HIGH 70

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00192 Published 2026-10-29 Partial fix · 1.7.6 CWE-400

TI-2026-22761 CVE-2026-28498 · GHSA-m344-f55w-2m6j

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

HIGH 69

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0024 Published 2026-03-16 Partial fix · 1.6.9 CWE-354

TI-2026-22754 CVE-2026-28490 · GHSA-7432-952r-cw78

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

HIGH 69

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00144 Published 2026-03-16 Partial fix · 1.6.9 CWE-203

TI-2026-79521 CVE-2026-114618 · GHSA-fch4-3c6x-j4gc

Authlib default JWT bearer grant accepts assertions for the wrong audience

HIGH 65

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00351 Published 2026-10-22 Partial fix · 1.9.0 CWE-1188

TI-2026-36246 CVE-2026-48990 · GHSA-wphv-vfrh-23q5

joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

MEDIUM 63

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00237 Published 2026-06-17 Fixed in 1.6.7 CWE-400

TI-2026-52874 CVE-2026-75509

joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

MEDIUM 62

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00124 Published 2026-08-24 Partial fix · 1.7.3 CWE-290

TI-2026-32577 CVE-2026-44681 · GHSA-r95x-qfjj-fjj2

Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

MEDIUM 60

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00249 Published 2026-05-27 Partial fix · 1.6.12, 1.7.1 CWE-601

TI-2026-79523 CVE-2026-114620 · GHSA-x4rv-c3wx-4cr8

Server-side request forgery in Authlib JWT authorization requests

MEDIUM 58

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00385 Published 2026-10-22 Partial fix · 1.9.0 CWE-918

TI-2026-30024 CVE-2026-41425 · GHSA-jj8c-mmj3-mmgv

Authlib: Cross-site request forging when using cache

MEDIUM 58

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00106 Published 2026-04-24 Partial fix · 1.6.11 CWE-352

TI-2026-79522 CVE-2026-114619 · GHSA-q686-2qmg-hqc7

Authlib OpenID implicit grant issues ID tokens without openid scope

MEDIUM 54

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00162 Published 2026-10-22 Partial fix · 1.9.0 CWE-863

TI-2026-79517 CVE-2026-114614 · GHSA-jj7h-c3hg-m23x

Authlib TLS check bypass lets cleartext URLs reach external hosts

MEDIUM 50

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00273 Published 2026-10-22 Partial fix · 1.8.0 CWE-601

TI-2026-63856 CVE-2026-96760 · GHSA-6m87-8wg6-hh8w · GHSA-6v38-4h7w-rj9h

Authlib library contains a signature‑verification bypass vulnerability

MEDIUM 49

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00433 Published 2026-09-28 Partial fix · 1.9.0 CWE-20

TI-2026-79519 CVE-2026-114616 · GHSA-8m4g-j4wp-wgcg

Authlib accepts empty HMAC keys, allowing JWT signature forgery

MEDIUM 41

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00299 Published 2026-10-22 Partial fix · 1.9.1 CWE-1391

TI-2026-81427 CVE-2026-116672 · GHSA-c73q-w75p-j82v

Authlib RFC 7592 examples allow changing other clients' registrations

MEDIUM 40

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00274 Published 2026-10-27 Partial fix · 1.9.1 CWE-1188

Open these records in search →

Critical	7
High	11
Medium	11
Low	2
No CVSS	0