Vulnerabilities

TI-2026-79523 CVE-2026-114620 · GHSA-x4rv-c3wx-4cr8

Server-side request forgery in Authlib JWT authorization requests

MEDIUM 58

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00385 Published 2026-10-22 Partial fix · 1.9.0 CWE-918

TI-2026-79522 CVE-2026-114619 · GHSA-q686-2qmg-hqc7

Authlib OpenID implicit grant issues ID tokens without openid scope

MEDIUM 54

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00162 Published 2026-10-22 Partial fix · 1.9.0 CWE-863

TI-2026-79521 CVE-2026-114618 · GHSA-fch4-3c6x-j4gc

Authlib default JWT bearer grant accepts assertions for the wrong audience

HIGH 65

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00351 Published 2026-10-22 Partial fix · 1.9.0 CWE-1188

TI-2026-79520 CVE-2026-114617 · GHSA-c5mf-xmp2-59rc

Authlib ID token can disable its own nonce validation

LOW 19

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00265 Published 2026-10-22 Partial fix · 1.9.0 CWE-294

TI-2026-79519 CVE-2026-114616 · GHSA-8m4g-j4wp-wgcg

Authlib accepts empty HMAC keys, allowing JWT signature forgery

MEDIUM 41

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00299 Published 2026-10-22 Partial fix · 1.9.1 CWE-1391

TI-2026-79518 CVE-2026-114615 · GHSA-7vr2-2fgp-9w7p

Authlib fix bypass lets attackers forge HS256 tokens with PEM keys

HIGH 74

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00213 Published 2026-10-22 Partial fix · 1.9.0 CWE-184

TI-2026-79517 CVE-2026-114614 · GHSA-jj7h-c3hg-m23x

Authlib TLS check bypass lets cleartext URLs reach external hosts

MEDIUM 50

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00273 Published 2026-10-22 Partial fix · 1.8.0 CWE-601

TI-2026-30067 CVE-2026-41479 · GHSA-w8p2-r796-3vmq

Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

LOW 24

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00257 Published 2026-06-22 Partial fix · 1.6.10, 1.7.1 CWE-601

TI-2026-32577 CVE-2026-44681 · GHSA-r95x-qfjj-fjj2

Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

MEDIUM 60

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00249 Published 2026-05-27 Partial fix · 1.6.12, 1.7.1 CWE-601

TI-2026-30024 CVE-2026-41425 · GHSA-jj8c-mmj3-mmgv

Authlib: Cross-site request forging when using cache

MEDIUM 58

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00106 Published 2026-04-24 Partial fix · 1.6.11 CWE-352

TI-2026-22761 CVE-2026-28498 · GHSA-m344-f55w-2m6j

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

HIGH 69

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0024 Published 2026-03-16 Partial fix · 1.6.9 CWE-354

TI-2026-22754 CVE-2026-28490 · GHSA-7432-952r-cw78

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

HIGH 69

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00144 Published 2026-03-16 Partial fix · 1.6.9 CWE-203

TI-2026-22305 CVE-2026-27962 · GHSA-wvwj-cvrp-7pv5

Authlib JWS JWK Header Injection: Signature Verification Bypass

HIGH 80

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0057 Published 2026-03-16 Fixed in 1.6.9 CWE-347

TI-2026-22996 CVE-2026-28802 · GHSA-7wc2-qxgw-g8gg

Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

MEDIUM 40

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00538 Published 2026-03-06 Partial fix · 1.6.7 CWE-347

TI-2025-41738 CVE-2025-68158 · GHSA-fg6f-75jq-6523

Authlib: 1-click Account Takeover

HIGH 71

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00272 Published 2026-01-08 Partial fix · 1.6.6 CWE-352

TI-2025-38896 CVE-2025-62706 · GHSA-g7f3-828f-7h7m

Authlib : JWE zip=DEF decompression bomb enables DoS

LOW 29

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00458 Published 2025-10-22 Partial fix · 1.6.5 CWE-400

TI-2025-38269 CVE-2025-61920 · GHSA-pq5p-34cr-23v9

Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

LOW 34

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00638 Published 2025-10-10 Fixed in 1.6.5 CWE-20

TI-2025-36973 CVE-2025-59420 · GHSA-9ggr-2464-2j32

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

HIGH 72

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00275 Published 2025-09-22 Fixed in 1.6.4 CWE-345

TI-2024-25068 CVE-2024-37568 · GHSA-5357-c2jx-v7qh

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.

HIGH 72

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00388 Published 2024-06-09 Fixed in 1.3.1 CWE-284

Vulnerabilities

Filters