Authlib

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 5.5MediumOct 29, 2026Authlib joserfc Denial of serviceCVE-2026-119284## Summary joserfc 1.7.4 defines compact-JWS header, payload, and signature limits, but calls `value.split(b".")` before validating them. Python `bytes.split()` copies the attacker-controlled segments, so the current guard allocates roughly one complete payload before rejecting it. ## Reproduction ```bash .venv-research/bin/python 06-practical-testing/preauth-memory-profile.py ``` The input is resident before a fork-isolated verifier runs, and every signature is invalid. | Input | Peak RSS
• 7.5HighOct 29, 2026Authlib joserfc Denial of serviceCVE-2026-119283### Summary `joserfc.jwe.decrypt_json()`, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled `recipients` array of unbounded length and performs one full private-key decryption operation (`decrypt_cek`) for **every** recipient present in the input, with no cap on recipient count. An unauthenticated network attacker who can send a JWE General JSON document to any endpoint that decrypts it with an RSA key (e.g. RSA-OAEP) can force the victim to perform
• 8.8HighOct 27, 2026authlib Auth bypass / access controlCVE-2026-116672## Description ### Summary RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously registered client read, update, or delete its own registration, authenticated by a `registration_access_token` issued specifically to that client at registration time. The entire security model of this protocol depends on the server verifying that the token presented in the request actually belongs to the client identified in the request, not merely that the token is valid for some
• 9.1CriticalOct 15, 2026Authlib joserfc Auth bypass / access controlCVE-2026-102946joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat
• 9.1CriticalSep 28, 2026Authlib Crypto / certificateCVE-2026-96760Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. ## Root cause `authlib/jose/rfc7515/jws.py`, read on the installed 1.8.0 artifact: ```python is_valid = True # set before anything is checked for header_obj in obj["signatures"]:
• 5.4MediumJun 22, 2026authlibCVE-2026-41479Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state.
• 6.1MediumMay 27, 2026authlibCVE-2026-44681Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.
• 5.4MediumApr 24, 2026authlib CSRFCVE-2026-41425Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11.
• 7.5HighMar 16, 2026authlibCVE-2026-28498Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorit
• 6.5MediumMar 16, 2026authlib Information disclosureCVE-2026-28490Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements cor
• 9.1CriticalMar 16, 2026authlib Crypto / certificateCVE-2026-27962Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed
• 9.8CriticalMar 6, 2026authlib Crypto / certificateCVE-2026-28802Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
• 5.7MediumJan 8, 2026authlib CSRFCVE-2025-68158Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the c

See every Authlib entry on the dashboard.

Top products

• Authlib10 CVEs in the last year, 3 critical
• joserfc3 CVEs in the last year, 1 critical

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CERT/CC · Sep 28, 2026VU#762428: Authlib library contains a signature‑verification bypass vulnerabilityCVE-2026-96760