python-authlib vulnerabilities (Debian)
22 vulnerabilities.
-
python-authlibDebian Authlib RFC 7592 examples omit registration-access-token client binding 8.8 High -
python-authlibDebian Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF 5.4 Medium -
python-authlibDebian Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens 4.6 Medium -
python-authlibDebian Authlib: Default JWT bearer grant accepts assertions for the wrong audience 6.8 Medium -
python-authlibDebian Authlib: ID token can disable its own nonce validation via the nonce_supported claim 4.2 Medium -
python-authlibDebian Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) 7.4 High -
python-authlibDebian Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys 7.4 High -
python-authlibDebian Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts 2.6 Low -
python-authlibDebian CVE-2026-104056 9.8 Critical -
python-authlibDebian Authlib library contains a signature‑verification bypass vulnerability 9.8 Critical -
python-authlibDebian Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type 5.4 Medium -
python-authlibDebian Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization 6.1 Medium -
python-authlibDebian Authlib: Cross-site request forging when using cache 5.4 Medium -
python-authlibDebian Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding 8.2 High -
python-authlibDebian Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle 8.3 High -
python-authlibDebian Authlib JWS JWK Header Injection: Signature Verification Bypass 9.1 Critical -
python-authlibDebian Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification 7.7 High -
python-authlibDebian Authlib: 1-click Account Takeover 5.7 Medium -
python-authlibDebian Authlib : JWE zip=DEF decompression bomb enables DoS 6.5 Medium -
python-authlibDebian Authlib is vulnerable to Denial of Service via Oversized JOSE Segments 7.5 High -
python-authlibDebian Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) 7.5 High -
python-authlibDebian Authlib has algorithm confusion with asymmetric public keys 7.5 High