CVE-2026-62995 | | | 2026-07-29 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joser… |
CVE-2026-49852 | | | 2026-07-17 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.6.8, joserfc.jwt.decode… |
CVE-2026-41479 | Medium | 5.4 | 2026-06-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned… |
CVE-2026-48990 | Medium | 5.3 | 2026-06-17 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions 1.3.4 through 1.6.5, jo… |
CVE-2026-44681 | Medium | 6.1 | 2026-05-27 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImpli… |
CVE-2026-41425 | Medium | 5.4 | 2026-04-24 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integra… |
CVE-2026-28498 | High | 7.5 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib… |
CVE-2026-28490 | Medium | 6.5 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified… |
CVE-2026-27962 | Critical | 9.1 | 2026-03-16 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implem… |
CVE-2026-28802 | Critical | 9.8 | 2026-03-06 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malic… |
CVE-2026-27932 | High | 7.5 | 2026-03-03 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource ex… |
CVE-2025-68158 | Medium | 5.7 | 2026-01-08 | Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tie… |
CVE-2025-65015 | High | 7.5 | 2025-11-18 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1… |
CVE-2025-62706 | Medium | 6.5 | 2025-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decomp… |
CVE-2025-61920 | High | 7.5 | 2025-10-10 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT head… |
CVE-2025-59420 | High | 7.5 | 2025-09-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unkno… |
CVE-2024-37568 | High | 7.5 | 2024-06-09 | lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is a… |