Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

authlib

21 known vulnerabilities (2 critical, 9 high, 9 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
1.9.5 (Nov 5, 2026): no advisory affects it
Newest unaffected release
1.9.5 (Nov 5, 2026), the latest release
Advisories
21 · 2 critical, 9 high, 9 medium, 1 low
Weekly downloads
28.9M
Releases
69 since 0.1.0 (Nov 18, 2017)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 21 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 21

  • Authlib RFC 7592 examples omit registration-access-token client binding

    Affected: from 0.15, fixed in 1.9.1.

    Fixed in 1.9.1 (released Oct 14, 2026, 13 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-114620Medium 5.4

    Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

    Affected: from 1.6.0, fixed in 1.9.0.

    Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-114619Medium 4.6

    Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-114618Medium 6.8

    Authlib: Default JWT bearer grant accepts assertions for the wrong audience

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-114617Medium 4.2

    Authlib: ID token can disable its own nonce validation via the nonce_supported claim

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

    Affected: fixed in 1.9.1.

    Fixed in 1.9.1 (released Oct 14, 2026, 8 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

    Affected: from 1.3.1, fixed in 1.9.0.

    Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

    Affected: fixed in 1.8.0; from 0.13, fixed in 1.8.0.

    Fixed in 1.8.0 (released Aug 30, 2026, 53 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-96760Critical 9.8

    Authlib library contains a signature‑verification bypass vulnerability

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Oct 14, 2026, 16 days after disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-41479Medium 5.4

    Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

    Affected: fixed in 1.6.10; from 1.7.0, fixed in 1.7.1.

    Fixed in 1.6.10 (released Apr 13, 2026, 70 days before disclosure) and 1.7.1 (released May 4, 2026, 49 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-44681Medium 6.1

    Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

    Affected: from 1.7.0, fixed in 1.7.1; fixed in 1.6.12.

    Fixed in 1.6.12 (released May 4, 2026, 23 days before disclosure) and 1.7.1 (released May 4, 2026, 23 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-41425Medium 5.4

    Authlib: Cross-site request forging when using cache

    Affected: fixed in 1.6.11.

    Fixed in 1.6.11 (released Apr 16, 2026, 8 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

    Affected: fixed in 1.6.9.

    Fixed in 1.6.9 (released Mar 2, 2026, 14 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

    Affected: fixed in 1.6.9.

    Fixed in 1.6.9 (released Mar 2, 2026, 14 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2026-27962Critical 9.1

    Authlib JWS JWK Header Injection: Signature Verification Bypass

    Affected: fixed in 1.6.9.

    Fixed in 1.6.9 (released Mar 2, 2026, 14 days before disclosure).

    The latest release, 1.9.5, is not affected.

Show all 21 advisoriesShow fewer advisories

  • Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

    Affected: from 1.6.5, fixed in 1.6.7.

    Fixed in 1.6.7 (released Feb 6, 2026, 28 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2025-68158Medium 5.7

    Authlib: 1-click Account Takeover

    Affected: from 1.0.0, fixed in 1.6.6.

    Fixed in 1.6.6 (released Dec 12, 2025, 27 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • CVE-2025-62706Medium 6.5

    Authlib : JWE zip=DEF decompression bomb enables DoS

    Affected: fixed in 1.6.5.

    Fixed in 1.6.5 (released Oct 2, 2025, 20 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

    Affected: fixed in 1.6.5.

    Fixed in 1.6.5 (released Oct 2, 2025, 8 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

    Affected: fixed in 1.6.4.

    Fixed in 1.6.4 (released Sep 17, 2025, 5 days before disclosure).

    The latest release, 1.9.5, is not affected.

  • lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.

    Affected: fixed in 1.3.1.

    Fixed in 1.3.1 (released Jun 4, 2024, 5 days before disclosure).

    The latest release, 1.9.5, is not affected.