Authlib

12 CVEs across 2 Authlib products. Browse Authlib vulnerabilities, severities, and proof-of-concept exploits.

Authlib products with known CVEs

ProductCVEs
Authlib12
Joserfc5
Authlib CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-629952026-07-29joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joser…
CVE-2026-498522026-07-17joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode…
CVE-2026-41479Medium5.42026-06-22Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned…
CVE-2026-48990Medium5.32026-06-17joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, jo…
CVE-2026-44681Medium6.12026-05-27Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImpli…
CVE-2026-41425Medium5.42026-04-24Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integra…
CVE-2026-28498High7.52026-03-16Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib…
CVE-2026-28490Medium6.52026-03-16Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified…
CVE-2026-27962Critical9.12026-03-16Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implem…
CVE-2026-28802Critical9.82026-03-06Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malic…
CVE-2026-27932High7.52026-03-03joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource ex…
CVE-2025-68158Medium5.72026-01-08Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tie…
CVE-2025-65015High7.52025-11-18joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1…
CVE-2025-62706Medium6.52025-10-22Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decomp…
CVE-2025-61920High7.52025-10-10Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT head…
CVE-2025-59420High7.52025-09-22Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unkno…
CVE-2024-37568High7.52024-06-09lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is a…