{"id":"CVE-2025-59420","aliases":["DEBIAN-CVE-2025-59420","DLA-4352-1","EUVD-2025-30790","GHSA-9ggr-2464-2j32","PYSEC-2026-1200","ROOT-APP-PYPI-CVE-2025-59420","UBUNTU-CVE-2025-59420","USN-8065-1"],"status":"published","title":"Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00275,"percentile":0.20129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345","CWE-863"],"published":"2025-09-22T14:42:12Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"PyPI","package":"authlib","fixed_in":["1.6.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-authlib","fixed_in":["1.2.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-authlib","fixed_in":["1.6.0-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-authlib","fixed_in":["1.6.4-1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-Authlib","fixed_in":["1.3.1+root.io.1","1.6.3+root.io.1","1.6.2+root.io.1","1.6.0+root.io.1","0.15.5+root.io.1","1.3.2+root.io.1","1.6.1+root.io.1","1.3.1+root.io.2","1.6.3+root.io.2","0.15.5+root.io.3","1.6.0+root.io.2","1.6.3+root.io.3","0.15.5+root.io.4","0.15.5+root.io.5","1.6.1+root.io.2","1.6.0+root.io.3","1.6.3+root.io.4","1.6.1+root.io.3","0.15.5+root.io.6","1.6.0+root.io.4","1.6.3+root.io.5","1.6.1+root.io.4","0.15.5+root.io.7","0.15.5+root.io.8","1.6.1+root.io.5","0.15.5+root.io.9","1.6.3+root.io.6","1.3.1+root.io.3","1.6.2+root.io.2","1.6.0+root.io.5","1.6.1+root.io.6","1.3.2+root.io.2"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"Authlib","fixed_in":["0.15.5+aikido.9","1.6.3+aikido.6","1.3.1+aikido.3","1.6.2+aikido.2","1.6.0+aikido.5","1.6.1+aikido.6","1.3.2+aikido.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-authlib","fixed_in":["0.15.5-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-authlib","fixed_in":["1.3.0-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1+deb12u1"}]}],"versions":["1.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1+deb13u1"}]}],"versions":["1.6.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1"}]}],"versions":["1.6.0-1","1.6.1-1","1.6.3-1"]},{"source":"osv","ecosystem":"Debian:11","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.4-1+deb11u1"}]}],"versions":["0.15.4-1"],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4"}]}],"versions":["0.1","0.10","0.11","0.12","0.12.1","0.13","0.14","0.14.1","0.14.2","0.14.3","0.15","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.1rc0","0.2","0.2.1","0.3","0.4","0.4.1","0.5","0.5.1","0.6","0.7","0.8","0.9","1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0rc1","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3"]},{"source":"osv","ecosystem":"PyPI","package":"authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4"}]}],"versions":["0.1","0.10","0.11","0.12","0.12.1","0.13","0.14","0.14.1","0.14.2","0.14.3","0.15","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.1rc0","0.2","0.2.1","0.3","0.4","0.4.1","0.5","0.5.1","0.6","0.7","0.8","0.9","1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0rc1","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3"]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-Authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1+root.io.1"},{"fixed":"1.6.3+root.io.1"},{"fixed":"1.6.2+root.io.1"},{"fixed":"1.6.0+root.io.1"},{"fixed":"0.15.5+root.io.1"},{"fixed":"1.3.2+root.io.1"},{"fixed":"1.6.1+root.io.1"},{"fixed":"1.3.1+root.io.2"},{"fixed":"1.6.3+root.io.2"},{"fixed":"0.15.5+root.io.3"},{"fixed":"1.6.0+root.io.2"},{"fixed":"1.6.3+root.io.3"},{"fixed":"0.15.5+root.io.4"},{"fixed":"0.15.5+root.io.5"},{"fixed":"1.6.1+root.io.2"},{"fixed":"1.6.0+root.io.3"},{"fixed":"1.6.3+root.io.4"},{"fixed":"1.6.1+root.io.3"},{"fixed":"0.15.5+root.io.6"},{"fixed":"1.6.0+root.io.4"},{"fixed":"1.6.3+root.io.5"},{"fixed":"1.6.1+root.io.4"},{"fixed":"0.15.5+root.io.7"},{"fixed":"0.15.5+root.io.8"},{"fixed":"1.6.1+root.io.5"},{"fixed":"0.15.5+root.io.9"},{"fixed":"1.6.3+root.io.6"},{"fixed":"1.3.1+root.io.3"},{"fixed":"1.6.2+root.io.2"},{"fixed":"1.6.0+root.io.5"},{"fixed":"1.6.1+root.io.6"},{"fixed":"1.3.2+root.io.2"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"Authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.5+aikido.9"},{"fixed":"1.6.3+aikido.6"},{"fixed":"1.3.1+aikido.3"},{"fixed":"1.6.2+aikido.2"},{"fixed":"1.6.0+aikido.5"},{"fixed":"1.6.1+aikido.6"},{"fixed":"1.3.2+aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.5-1ubuntu0.1~esm1"}]}],"versions":["0.15.4-1","0.15.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1ubuntu0.1~esm1"}]}],"versions":["1.2.1-1","1.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-1","1.5.2-1","1.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.7-1","1.7.2-1","1.7.2-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1","1.6.5-1","1.6.6-1","1.6.7-1","1.6.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.5-1ubuntu0.1~esm1"}]}],"versions":["0.15.4-1","0.15.5-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1ubuntu0.1~esm1"}]}],"versions":["1.2.1-1","1.3.0-1"],"bundled":5}],"products":[{"vendor":"authlib","product":"authlib"}],"references":[{"url":"https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479df","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59420","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9ggr-2464-2j32","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59420.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-59420","tags":["advisory"]},{"url":"https://github.com/authlib/authlib","tags":["package"]},{"url":"https://pypi.org/project/authlib","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-59420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59420","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8065-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-37568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-61920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-62706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-68158","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-59420","title":"Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.","status":"published","published":"2025-09-22T17:28:53.869Z","modified":"2025-11-03T17:45:19.901Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-345","CWE-863"],"updated_at":"2026-11-02T14:32:48.167635Z"}],"euvd":[{"id":"EUVD-2025-30790","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.","status":"published","published":"2025-09-22T17:28:53Z","modified":"2025-11-03T17:45:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:35.000596Z"}],"ghsa":[{"id":"GHSA-9ggr-2464-2j32","title":"Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)","description":"## Summary\nAuthlib’s JWS verification accepts tokens that declare unknown critical header parameters (`crit`), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, `bork` or `cnf`) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation.\n\n## Affected Component and Versions\n- Library: Authlib (JWS verification)\n- API: `authlib.jose.JsonWebSignature.deserialize_compact(...)`\n- Version tested: 1.6.3\n- Configuration: Default; no allowlist or special handling for `crit`\n\n## Details\nRFC 7515 (JWS) §4.1.11 defines `crit` as a “must‑understand” list: recipients MUST understand and enforce every header parameter listed in `crit`, otherwise they MUST reject the token. Security‑sensitive semantics such as token binding (e.g., `cnf` from RFC 7800) are often conveyed via `crit`.\n\nObserved behavior with Authlib 1.6.3:\n- When a compact JWS contains a protected header with `crit: [\"cnf\"]` and a `cnf` object, or `crit: [\"bork\"]` with an unknown parameter, Authlib verifies the signature and returns the payload without rejecting the token or enforcing semantics of the critical parameter.\n- By contrast, Java Nimbus JOSE+JWT (9.37.x) and Node `jose` v5 both reject such tokens by default when `crit` lists unknown names.\n\nImpact in heterogeneous fleets:\n- A strict ingress/gateway (Nimbus/Node) rejects a token, but a lenient Python microservice (Authlib) accepts the same token. This split‑brain acceptance bypasses intended security policies and can enable replay or privilege escalation if `crit` carries binding or policy information.\n\n## Proof of Concept (PoC)\nThis repository provides a multi‑runtime PoC demonstrating the issue across Python (Authlib), Node (`jose` v5), and Java (Nimbus).\n\n### Prerequisites\n- Python 3.8+\n- Node.js 18+\n- Java 11+ with Maven\n\n### Setup\n\nEnter the directory **authlib-crit-bypass-poc** \u0026 run following commands.\n```bash\nmake setup\nmake tokens\n```\n\n### Tokens minted\n- `tokens/unknown_crit.jwt` with protected header:\n  `{ \"alg\": \"HS256\", \"crit\": [\"bork\"], \"bork\": \"x\" }`\n- `tokens/cnf_header.jwt` with protected header:\n  `{ \"alg\": \"HS256\", \"crit\": [\"cnf\"], \"cnf\": {\"jkt\": \"thumb-42\"} }`\n\n### Reproduction\nRun the cross‑runtime demo:\n```bash\nmake  demo\n```\n\nExpected output for each token (strict verifiers reject; Authlib accepts):\n\nFor `tokens/unknown_crit.jwt`:\n```\nStrict(Nimbus): REJECTED (unknown critical header: bork)\nStrict(Node jose): REJECTED (unrecognized crit)\nLenient(Authlib): ACCEPTED -\u003e payload={'sub': '123', 'role': 'user'}\n```\n\nFor `tokens/cnf_header.jwt`:\n```\nStrict(Nimbus): REJECTED (unknown critical header: cnf)\nStrict(Node jose): REJECTED (unrecognized crit)\nLenient(Authlib): ACCEPTED -\u003e payload={'sub': '123', 'role': 'user'}\n```\n\nEnvironment notes:\n- Authlib version used: `1.6.3` (from PyPI)\n- Node `jose` version: `^5`\n- Nimbus JOSE+JWT version: `9.37.x`\n- HS256 secret is 32 bytes to satisfy strict verifiers: `0123456789abcdef0123456789abcdef`\n\n## Impact\n- Class: Violation of JWS `crit` “must‑understand” semantics; specification non‑compliance leading to authentication/authorization policy bypass.\n- Who is impacted: Any service that relies on `crit` to carry mandatory security semantics (e.g., token binding via `cnf`) or operates in a heterogeneous fleet with strict verifiers elsewhere.\n- Consequences: Split‑brain acceptance (gateway rejects while a backend accepts), replay, or privilege escalation if critical semantics are ignored.\n\n## References\n- RFC 7515: JSON Web Signature (JWS), §4.1.11 `crit`\n- RFC 7800: Proof‑of‑Possession Key Semantics for JWTs (`cnf`)","status":"published","published":"2025-09-22T14:42:12Z","modified":"2025-11-03T18:32:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-345","CWE-863"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-59420","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.","status":"published","published":"2025-09-22T18:15:46.91Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-345","CWE-863"],"updated_at":"2026-11-02T14:11:30.865098Z"}],"osv":[{"id":"CVE-2025-59420","title":"Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.","status":"published","published":"2025-09-22T17:28:53.869Z","modified":"2026-10-28T02:31:11.888245384Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-345","CWE-863"],"updated_at":"2026-11-02T15:44:51.190588Z"},{"id":"DEBIAN-CVE-2025-59420","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.","status":"published","published":"2025-09-22T18:15:46.91Z","modified":"2026-10-23T17:47:22.187065317Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-9ggr-2464-2j32","title":"Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)","description":"## Summary\nAuthlib’s JWS verification accepts tokens that declare unknown critical header parameters (`crit`), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, `bork` or `cnf`) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation.\n\n## Affected Component and Versions\n- Library: Authlib (JWS verification)\n- API: `authlib.jose.JsonWebSignature.deserialize_compact(...)`\n- Version tested: 1.6.3\n- Configuration: Default; no allowlist or special handling for `crit`\n\n## Details\nRFC 7515 (JWS) §4.1.11 defines `crit` as a “must‑understand” list: recipients MUST understand and enforce every header parameter listed in `crit`, otherwise they MUST reject the token. Security‑sensitive semantics such as token binding (e.g., `cnf` from RFC 7800) are often conveyed via `crit`.\n\nObserved behavior with Authlib 1.6.3:\n- When a compact JWS contains a protected header with `crit: [\"cnf\"]` and a `cnf` object, or `crit: [\"bork\"]` with an unknown parameter, Authlib verifies the signature and returns the payload without rejecting the token or enforcing semantics of the critical parameter.\n- By contrast, Java Nimbus JOSE+JWT (9.37.x) and Node `jose` v5 both reject such tokens by default when `crit` lists unknown names.\n\nImpact in heterogeneous fleets:\n- A strict ingress/gateway (Nimbus/Node) rejects a token, but a lenient Python microservice (Authlib) accepts the same token. This split‑brain acceptance bypasses intended security policies and can enable replay or privilege escalation if `crit` carries binding or policy information.\n\n## Proof of Concept (PoC)\nThis repository provides a multi‑runtime PoC demonstrating the issue across Python (Authlib), Node (`jose` v5), and Java (Nimbus).\n\n### Prerequisites\n- Python 3.8+\n- Node.js 18+\n- Java 11+ with Maven\n\n### Setup\n\nEnter the directory **authlib-crit-bypass-poc** \u0026 run following commands.\n```bash\nmake setup\nmake tokens\n```\n\n### Tokens minted\n- `tokens/unknown_crit.jwt` with protected header:\n  `{ \"alg\": \"HS256\", \"crit\": [\"bork\"], \"bork\": \"x\" }`\n- `tokens/cnf_header.jwt` with protected header:\n  `{ \"alg\": \"HS256\", \"crit\": [\"cnf\"], \"cnf\": {\"jkt\": \"thumb-42\"} }`\n\n### Reproduction\nRun the cross‑runtime demo:\n```bash\nmake  demo\n```\n\nExpected output for each token (strict verifiers reject; Authlib accepts):\n\nFor `tokens/unknown_crit.jwt`:\n```\nStrict(Nimbus): REJECTED (unknown critical header: bork)\nStrict(Node jose): REJECTED (unrecognized crit)\nLenient(Authlib): ACCEPTED -\u003e payload={'sub': '123', 'role': 'user'}\n```\n\nFor `tokens/cnf_header.jwt`:\n```\nStrict(Nimbus): REJECTED (unknown critical header: cnf)\nStrict(Node jose): REJECTED (unrecognized crit)\nLenient(Authlib): ACCEPTED -\u003e payload={'sub': '123', 'role': 'user'}\n```\n\nEnvironment notes:\n- Authlib version used: `1.6.3` (from PyPI)\n- Node `jose` version: `^5`\n- Nimbus JOSE+JWT version: `9.37.x`\n- HS256 secret is 32 bytes to satisfy strict verifiers: `0123456789abcdef0123456789abcdef`\n\n## Impact\n- Class: Violation of JWS `crit` “must‑understand” semantics; specification non‑compliance leading to authentication/authorization policy bypass.\n- Who is impacted: Any service that relies on `crit` to carry mandatory security semantics (e.g., token binding via `cnf`) or operates in a heterogeneous fleet with strict verifiers elsewhere.\n- Consequences: Split‑brain acceptance (gateway rejects while a backend accepts), replay, or privilege escalation if critical semantics are ignored.\n\n## References\n- RFC 7515: JSON Web Signature (JWS), §4.1.11 `crit`\n- RFC 7800: Proof‑of‑Possession Key Semantics for JWTs (`cnf`)","status":"published","published":"2025-09-22T14:42:12Z","modified":"2026-09-10T03:50:28.176043463Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-345","CWE-863"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"PYSEC-2026-1200","title":"Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)","description":"## Summary\nAuthlib’s JWS verification accepts tokens that declare unknown critical header parameters (`crit`), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, `bork` or `cnf`) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation.\n\n## Affected Component and Versions\n- Library: Authlib (JWS verification)\n- API: `authlib.jose.JsonWebSignature.deserialize_compact(...)`\n- Version tested: 1.6.3\n- Configuration: Default; no allowlist or special handling for `crit`\n\n## Details\nRFC 7515 (JWS) §4.1.11 defines `crit` as a “must‑understand” list: recipients MUST understand and enforce every header parameter listed in `crit`, otherwise they MUST reject the token. Security‑sensitive semantics such as token binding (e.g., `cnf` from RFC 7800) are often conveyed via `crit`.\n\nObserved behavior with Authlib 1.6.3:\n- When a compact JWS contains a protected header with `crit: [\"cnf\"]` and a `cnf` object, or `crit: [\"bork\"]` with an unknown parameter, Authlib verifies the signature and returns the payload without rejecting the token or enforcing semantics of the critical parameter.\n- By contrast, Java Nimbus JOSE+JWT (9.37.x) and Node `jose` v5 both reject such tokens by default when `crit` lists unknown names.\n\nImpact in heterogeneous fleets:\n- A strict ingress/gateway (Nimbus/Node) rejects a token, but a lenient Python microservice (Authlib) accepts the same token. This split‑brain acceptance bypasses intended security policies and can enable replay or privilege escalation if `crit` carries binding or policy information.\n\n## Proof of Concept (PoC)\nThis repository provides a multi‑runtime PoC demonstrating the issue across Python (Authlib), Node (`jose` v5), and Java (Nimbus).\n\n### Prerequisites\n- Python 3.8+\n- Node.js 18+\n- Java 11+ with Maven\n\n### Setup\n\nEnter the directory **authlib-crit-bypass-poc** \u0026 run following commands.\n```bash\nmake setup\nmake tokens\n```\n\n### Tokens minted\n- `tokens/unknown_crit.jwt` with protected header:\n  `{ \"alg\": \"HS256\", \"crit\": [\"bork\"], \"bork\": \"x\" }`\n- `tokens/cnf_header.jwt` with protected header:\n  `{ \"alg\": \"HS256\", \"crit\": [\"cnf\"], \"cnf\": {\"jkt\": \"thumb-42\"} }`\n\n### Reproduction\nRun the cross‑runtime demo:\n```bash\nmake  demo\n```\n\nExpected output for each token (strict verifiers reject; Authlib accepts):\n\nFor `tokens/unknown_crit.jwt`:\n```\nStrict(Nimbus): REJECTED (unknown critical header: bork)\nStrict(Node jose): REJECTED (unrecognized crit)\nLenient(Authlib): ACCEPTED -\u003e payload={'sub': '123', 'role': 'user'}\n```\n\nFor `tokens/cnf_header.jwt`:\n```\nStrict(Nimbus): REJECTED (unknown critical header: cnf)\nStrict(Node jose): REJECTED (unrecognized crit)\nLenient(Authlib): ACCEPTED -\u003e payload={'sub': '123', 'role': 'user'}\n```\n\nEnvironment notes:\n- Authlib version used: `1.6.3` (from PyPI)\n- Node `jose` version: `^5`\n- Nimbus JOSE+JWT version: `9.37.x`\n- HS256 secret is 32 bytes to satisfy strict verifiers: `0123456789abcdef0123456789abcdef`\n\n## Impact\n- Class: Violation of JWS `crit` “must‑understand” semantics; specification non‑compliance leading to authentication/authorization policy bypass.\n- Who is impacted: Any service that relies on `crit` to carry mandatory security semantics (e.g., token binding via `cnf`) or operates in a heterogeneous fleet with strict verifiers elsewhere.\n- Consequences: Split‑brain acceptance (gateway rejects while a backend accepts), replay, or privilege escalation if critical semantics are ignored.\n\n## References\n- RFC 7515: JSON Web Signature (JWS), §4.1.11 `crit`\n- RFC 7800: Proof‑of‑Possession Key Semantics for JWTs (`cnf`)","status":"published","published":"2026-07-07T16:03:05.178057Z","modified":"2026-07-07T17:46:32.324326134Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"ROOT-APP-PYPI-CVE-2025-59420","title":"CVE-2025-59420 in rootio-Authlib - Patched by Root","description":"Root has patched CVE-2025-59420 in the rootio-Authlib package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-06-03T14:52:12Z","modified":"2026-06-03T19:30:07.626567329Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2025-59420","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.","status":"published","published":"2025-09-22T18:15:00Z","modified":"2026-10-17T12:55:54.725529089Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"DLA-4352-1","title":"python-authlib - security update","status":"published","published":"2025-10-29T00:00:00Z","modified":"2025-10-29T04:34:52.744951Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-8065-1","title":"python-authlib vulnerabilities","description":"Millie Solem discovered that Authlib did not properly restrict algorithm\nselection during JWT verification, allowing HMAC verification with\nasymmetric public keys when no algorithm was specified. A remote attacker\ncould possibly use this issue to bypass signature verification and forge\ntokens, resulting in authentication bypass or privilege escalation.\n(CVE-2024-37568)\n\nMuhammad Noman Ilyas discovered that Authlib did not properly enforce\ncritical header parameter handling during JSON Web Signature verification,\nleading to unknown critical parameters being incorrectly accepted. A remote\nattacker could possibly use this issue to bypass security policies in mixed\ndeployments, resulting in authentication bypass, replay attacks, or\nprivilege escalation. (CVE-2025-59420)\n\nMuhammad Noman Ilyas discovered that Authlib did not properly limit the\nsize of JSON Web Signature or JSON Web Token header and signature segments.\nA remote attacker could possibly use this issue to cause excessive memory\nor processor consumption, leading to a denial of service. (CVE-2025-61920)\n\nMuhammad Noman Ilyas discovered that Authlib performed unbounded\ndecompression when processing certain compressed encrypted tokens. A remote\nattacker could possibly use this issue to send a specially crafted token\nthat can be expanded to a large size during decompression, causing a denial\nof service. (CVE-2025-62706)\n\nIt was discovered that Authlib did not properly bind cached state\ninformation to the initiating user session during OAuth authentication\nflows. A remote attacker could possibly use this issue to perform cross-\nsite request forgery attacks, resulting in unauthorized actions or\nauthentication bypass. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2025-68158)","status":"published","published":"2026-02-25T20:43:00Z","modified":"2026-04-27T18:41:08.675153Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}