Authlib vulnerabilities

Products

• Authlib 22
• Joserfc 9

Newest

• authlib joserfc joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection CVE-2026-119284 Fix available 6.9 MediumOctober 29, 2026
• authlib joserfc joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption CVE-2026-119283 Fix available 7.5 HighOctober 29, 2026
• authlib Authlib RFC 7592 examples omit registration-access-token client binding CVE-2026-116672 Fix available 8.8 HighOctober 27, 2026
• authlib Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF CVE-2026-114620 Fix available 5.4 MediumOctober 22, 2026
• authlib Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens CVE-2026-114619 Fix available 4.6 MediumOctober 22, 2026
• authlib Authlib: Default JWT bearer grant accepts assertions for the wrong audience CVE-2026-114618 Fix available 6.8 MediumOctober 22, 2026
• authlib Authlib: ID token can disable its own nonce validation via the nonce_supported claim CVE-2026-114617 Fix available 4.2 MediumOctober 22, 2026
• authlib Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) CVE-2026-114616 Fix available 7.4 HighOctober 22, 2026
• authlib Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys CVE-2026-114615 Fix available 7.4 HighOctober 22, 2026
• authlib Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts CVE-2026-114614 Fix available 2.6 LowOctober 22, 2026
• authlib joserfc joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json CVE-2026-102946 Fix available 9.1 CriticalOctober 15, 2026
• authlib CVE-2026-104056 CVE-2026-104056 9.8 CriticalOctober 1, 2026
• authlib Authlib library contains a signature‑verification bypass vulnerability CVE-2026-96760 Public exploitFix available 9.8 CriticalSeptember 28, 2026
• authlib joserfc joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) CVE-2026-75509 Fix available 6.5 MediumAugust 24, 2026
• authlib joserfc joserfc accepts JWT with padding, leading to JWT malleability CVE-2026-62995 Fix available 2.3 LowJuly 29, 2026
• authlib joserfc joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVE-2026-49852 Fix available 8.7 HighJuly 2, 2026
• authlib joserfc joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization CVE-2026-48990 Fix available 5.3 MediumJune 17, 2026
• authlib Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type CVE-2026-41479 Fix available 5.4 MediumJune 8, 2026
• authlib Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization CVE-2026-44681 Fix available 6.1 MediumMay 13, 2026
• authlib Authlib: Cross-site request forging when using cache CVE-2026-41425 Fix available 5.4 MediumApril 16, 2026
• authlib, red hat lightspeed core, ansible automation platform 2 +7 more +9 more Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding CVE-2026-28498 Fix available 8.2 HighMarch 16, 2026
• authlib Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle CVE-2026-28490 Fix available 8.3 HighMarch 16, 2026
• authlib, red hat lightspeed core, ansible automation platform 2 +7 more +9 more Authlib JWS JWK Header Injection: Signature Verification Bypass CVE-2026-27962 Fix available 9.1 CriticalMarch 16, 2026
• authlib, red hat ansible automation platform 2.6, quay 3.10 +5 more +7 more Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification CVE-2026-28802 Fix available 7.7 HighMarch 4, 2026
• authlib joserfc joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) CVE-2026-27932 Fix available 7.5 HighMarch 2, 2026
• authlib Authlib: 1-click Account Takeover CVE-2025-68158 Fix available 5.7 MediumJanuary 8, 2026
• authlib joserfc joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads CVE-2025-65015 Fix available 9.2 CriticalNovember 18, 2025
• authlib Authlib : JWE zip=DEF decompression bomb enables DoS CVE-2025-62706 Fix available 6.5 MediumOctober 10, 2025
• authlib Authlib is vulnerable to Denial of Service via Oversized JOSE Segments CVE-2025-61920 Fix available 7.5 HighOctober 10, 2025
• authlib Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) CVE-2025-59420 Fix available 7.5 HighSeptember 22, 2025
• authlib Authlib has algorithm confusion with asymmetric public keys CVE-2024-37568 Fix available 7.5 HighJune 9, 2024