CVE-2025-61920

Summary Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service.

Impact

• Attack vector: unauthenticated network attacker submits a malicious JWS/JWT.

• Effect: base64 decode + JSON/crypto processing of huge buffers pegs CPU and allocates large amounts of RAM; a single request can exhaust service capacity.

• Observed behaviour: on a test host, the legacy code verified a 500 MB header, consuming ~4 GB RSS and ~9 s CPU before failing.

• Severity: High. CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5).

Affected Versions Authlib ≤ 1.6.3 (and earlier) when verifying JWS/JWT tokens. Later snapshots with 256 KB header/signature limits are not affected.

Proof of concept

Local demo (do not run against third-party systems): Download jws_segment_dos_demo.py the PoC in direcotry authlib/ Run following Command

python3 jws_segment_dos_demo.py --variant both --sizes "500MB" --fork-per-case

Environment: Python 3.13.6, Authlib 1.6.4, Linux x86_64, CPUs=8 Sample output: Refined <img width="1295" height="306" alt="image" src="https://github.com/user-attachments/assets/6dd8410f-bc36-4717-8cee-649bac9bf291" />

The compilation script prints separate “[ATTACKER]” (token construction) and “[SERVER]” (Authlib verification) RSS deltas so defenders can distinguish client-side preparation from server-side amplification. Regression tests authlib/tests/dos/test_jose_dos.py further capture the issue; the saved original_util.py/original_jws.py reproductions still accept the malicious payload.

Remediation

• Apply the upstream patch that introduces decoded size limits:

• MAX_HEADER_SEGMENT_BYTES = 256 KB

• MAX_SIGNATURE_SEGMENT_BYTES = 256 KB

• Enforce Limits in authlib/jose/util.extract_segment and _extract_signature.

• Deploy the patched release immediately.

• For additional defence in depth, reject JWS/JWT inputs above a few kilobytes at the proxy or WAF layer, and rate-limit verification endpoints.

Workarounds (temporary)

• Enforce input size limits before handing tokens to Authlib.

• Use application-level throttling to reduce amplification risk.

Resources

• Demo script: jws_segment_dos_demo.py

• Tests: authlib/tests/dos/test_jose_dos.py

• OWASP JWT Cheat Sheet (DoS guidance)

Summary Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service.

Impact

• Attack vector: unauthenticated network attacker submits a malicious JWS/JWT.

• Effect: base64 decode + JSON/crypto processing of huge buffers pegs CPU and allocates large amounts of RAM; a single request can exhaust service capacity.

• Observed behaviour: on a test host, the legacy code verified a 500 MB header, consuming ~4 GB RSS and ~9 s CPU before failing.

• Severity: High. CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5).

Affected Versions Authlib ≤ 1.6.3 (and earlier) when verifying JWS/JWT tokens. Later snapshots with 256 KB header/signature limits are not affected.

Proof of concept

Local demo (do not run against third-party systems): Download jws_segment_dos_demo.py the PoC in direcotry authlib/ Run following Command

python3 jws_segment_dos_demo.py --variant both --sizes "500MB" --fork-per-case

Environment: Python 3.13.6, Authlib 1.6.4, Linux x86_64, CPUs=8 Sample output: Refined <img width="1295" height="306" alt="image" src="https://github.com/user-attachments/assets/6dd8410f-bc36-4717-8cee-649bac9bf291" />

The compilation script prints separate “[ATTACKER]” (token construction) and “[SERVER]” (Authlib verification) RSS deltas so defenders can distinguish client-side preparation from server-side amplification. Regression tests authlib/tests/dos/test_jose_dos.py further capture the issue; the saved original_util.py/original_jws.py reproductions still accept the malicious payload.

Remediation

• Apply the upstream patch that introduces decoded size limits:

• MAX_HEADER_SEGMENT_BYTES = 256 KB

• MAX_SIGNATURE_SEGMENT_BYTES = 256 KB

• Enforce Limits in authlib/jose/util.extract_segment and _extract_signature.

• Deploy the patched release immediately.

• For additional defence in depth, reject JWS/JWT inputs above a few kilobytes at the proxy or WAF layer, and rate-limit verification endpoints.

Workarounds (temporary)

• Enforce input size limits before handing tokens to Authlib.

• Use application-level throttling to reduce amplification risk.

Resources

• Demo script: jws_segment_dos_demo.py

• Tests: authlib/tests/dos/test_jose_dos.py

• OWASP JWT Cheat Sheet (DoS guidance)

Root has patched CVE-2025-61920 in the rootio-Authlib package for Root:PyPI. Multiple fixed versions available.

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.

These are all security issues fixed in the python311-Authlib-1.6.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-Authlib fixes the following issues:

• CVE-2025-61920: limited the size of the header to prevent DoS (bsc#1251921).

Millie Solem discovered that Authlib did not properly restrict algorithm selection during JWT verification, allowing HMAC verification with asymmetric public keys when no algorithm was specified. A remote attacker could possibly use this issue to bypass signature verification and forge tokens, resulting in authentication bypass or privilege escalation. (CVE-2024-37568)

Muhammad Noman Ilyas discovered that Authlib did not properly enforce critical header parameter handling during JSON Web Signature verification, leading to unknown critical parameters being incorrectly accepted. A remote attacker could possibly use this issue to bypass security policies in mixed deployments, resulting in authentication bypass, replay attacks, or privilege escalation. (CVE-2025-59420)

Muhammad Noman Ilyas discovered that Authlib did not properly limit the size of JSON Web Signature or JSON Web Token header and signature segments. A remote attacker could possibly use this issue to cause excessive memory or processor consumption, leading to a denial of service. (CVE-2025-61920)

Muhammad Noman Ilyas discovered that Authlib performed unbounded decompression when processing certain compressed encrypted tokens. A remote attacker could possibly use this issue to send a specially crafted token that can be expanded to a large size during decompression, causing a denial of service. (CVE-2025-62706)

It was discovered that Authlib did not properly bind cached state information to the initiating user session during OAuth authentication flows. A remote attacker could possibly use this issue to perform cross- site request forgery attacks, resulting in unauthorized actions or authentication bypass. This issue only affected Ubuntu 24.04 LTS. (CVE-2025-68158)