Vulnerabilities

TI-2026-82780 CVE-2026-119284 · GHSA-9pg5-8c7x-5hfx

Compact JWS parsing in joserfc allocates memory before size check

HIGH 70

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00192 Published 2026-10-29 Partial fix · 1.7.6 CWE-400

TI-2026-82772 CVE-2026-119283 · GHSA-jpxq-7h8p-2q76

Uncontrolled resource consumption in authlib joserfc

HIGH 72

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00229 Published 2026-10-29 Partial fix · 1.7.5 CWE-400

TI-2026-81427 CVE-2026-116672 · GHSA-c73q-w75p-j82v

Authlib RFC 7592 examples allow changing other clients' registrations

MEDIUM 40

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00274 Published 2026-10-27 Partial fix · 1.9.1 CWE-1188

TI-2026-79523 CVE-2026-114620 · GHSA-x4rv-c3wx-4cr8

Server-side request forgery in Authlib JWT authorization requests

MEDIUM 58

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00385 Published 2026-10-22 Partial fix · 1.9.0 CWE-918

TI-2026-79522 CVE-2026-114619 · GHSA-q686-2qmg-hqc7

Authlib OpenID implicit grant issues ID tokens without openid scope

MEDIUM 54

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00162 Published 2026-10-22 Partial fix · 1.9.0 CWE-863

TI-2026-79521 CVE-2026-114618 · GHSA-fch4-3c6x-j4gc

Authlib default JWT bearer grant accepts assertions for the wrong audience

HIGH 65

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00351 Published 2026-10-22 Partial fix · 1.9.0 CWE-1188

TI-2026-79520 CVE-2026-114617 · GHSA-c5mf-xmp2-59rc

Authlib ID token can disable its own nonce validation

LOW 19

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00265 Published 2026-10-22 Partial fix · 1.9.0 CWE-294

TI-2026-79519 CVE-2026-114616 · GHSA-8m4g-j4wp-wgcg

Authlib accepts empty HMAC keys, allowing JWT signature forgery

MEDIUM 41

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00299 Published 2026-10-22 Partial fix · 1.9.1 CWE-1391

TI-2026-79518 CVE-2026-114615 · GHSA-7vr2-2fgp-9w7p

Authlib fix bypass lets attackers forge HS256 tokens with PEM keys

HIGH 74

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00213 Published 2026-10-22 Partial fix · 1.9.0 CWE-184

TI-2026-79517 CVE-2026-114614 · GHSA-jj7h-c3hg-m23x

Authlib TLS check bypass lets cleartext URLs reach external hosts

MEDIUM 50

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00273 Published 2026-10-22 Partial fix · 1.8.0 CWE-601

TI-2026-74876 CVE-2026-102946

Signature verification bypass in joserfc JWS deserialization

HIGH 80

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00117 Published 2026-10-15 Partial fix · 1.7.4 CWE-290

TI-2026-65772 CVE-2026-104056 · GHSA-8wx9-759m-hfm8

Insufficient verification of data authenticity in Authlib

HIGH 82

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.002 Published 2026-10-01 Fix deferred CWE-345

TI-2026-63856 CVE-2026-96760 · GHSA-6m87-8wg6-hh8w · GHSA-6v38-4h7w-rj9h

Authlib library contains a signature‑verification bypass vulnerability

MEDIUM 49

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00433 Published 2026-09-28 Partial fix · 1.9.0 CWE-20

TI-2026-52874 CVE-2026-75509

joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)

MEDIUM 62

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00124 Published 2026-08-24 Partial fix · 1.7.3 CWE-290

TI-2026-44996 CVE-2026-62995

joserfc accepts JWT with padding, leading to JWT malleability

LOW 19

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00145 Published 2026-07-29 Partial fix · 1.7.2 CWE-345

TI-2026-36756 CVE-2026-49852 · GHSA-gg9x-qcx2-xmrh

joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)

HIGH 77

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00171 Published 2026-07-17 Fixed in 1.6.8 CWE-1391

TI-2026-30067 CVE-2026-41479 · GHSA-w8p2-r796-3vmq

Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

LOW 24

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00257 Published 2026-06-22 Partial fix · 1.6.10, 1.7.1 CWE-601

TI-2026-36246 CVE-2026-48990 · GHSA-wphv-vfrh-23q5

joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

MEDIUM 63

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00237 Published 2026-06-17 Fixed in 1.6.7 CWE-400

TI-2026-32577 CVE-2026-44681 · GHSA-r95x-qfjj-fjj2

Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

MEDIUM 60

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00249 Published 2026-05-27 Partial fix · 1.6.12, 1.7.1 CWE-601

TI-2026-30024 CVE-2026-41425 · GHSA-jj8c-mmj3-mmgv

Authlib: Cross-site request forging when using cache

MEDIUM 58

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00106 Published 2026-04-24 Partial fix · 1.6.11 CWE-352

TI-2026-22761 CVE-2026-28498 · GHSA-m344-f55w-2m6j

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

HIGH 69

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0024 Published 2026-03-16 Partial fix · 1.6.9 CWE-354

TI-2026-22754 CVE-2026-28490 · GHSA-7432-952r-cw78

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

HIGH 69

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00144 Published 2026-03-16 Partial fix · 1.6.9 CWE-203

TI-2026-22305 CVE-2026-27962 · GHSA-wvwj-cvrp-7pv5

Authlib JWS JWK Header Injection: Signature Verification Bypass

HIGH 80

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0057 Published 2026-03-16 Fixed in 1.6.9 CWE-347

TI-2026-22996 CVE-2026-28802 · GHSA-7wc2-qxgw-g8gg

Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

MEDIUM 40

Authlib is a Python library which builds OAuth and OpenID Connect servers.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00538 Published 2026-03-06 Partial fix · 1.6.7 CWE-347

TI-2026-22276 CVE-2026-27932 · GHSA-w5r5-m38g-f9f9

joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)

HIGH 72

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00462 Published 2026-03-03 Fixed in 1.6.3 CWE-770

Vulnerabilities

Filters