# authlib (PyPI) vulnerabilities 21 known vulnerabilities (2 critical, 9 high, 9 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.9.5 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 1.9.5 (Nov 5, 2026), the latest release - Weekly downloads: 28.9M - Releases: 69 since 0.1.0 (Nov 18, 2017) - Registry: https://pypi.org/project/authlib/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116672: 0.15.0 to 1.9.0 (1.9.1 is outside it) - CVE-2026-114620: 1.6.0 to 1.8.0 (1.9.0 is outside it) - CVE-2026-114619: 0.1.0 to 1.8.0 (1.9.0 is outside it) - CVE-2026-114618: 0.1.0 to 1.8.0 (1.9.0 is outside it) - CVE-2026-114617: 0.1.0 to 1.8.0 (1.9.0 is outside it) - CVE-2026-114616: 0.1.0 to 1.9.0 (1.9.1 is outside it) - CVE-2026-114615: 1.3.1 to 1.8.0 (1.9.0 is outside it) - CVE-2026-114614: 0.1.0 to 1.7.2 (1.8.0 is outside it) - CVE-2026-96760: 0.1.0 to 1.8.0 (1.9.0 is outside it) - CVE-2026-41479: 0.1.0 to 1.6.9 (1.6.10 is outside it); 1.7.0 (1.7.1 is outside it) - CVE-2026-44681: 0.1.0 to 1.6.11 (1.6.12 is outside it); 1.7.0 (1.7.1 is outside it) - CVE-2026-41425: 0.1.0 to 1.6.10 (1.6.11 is outside it) - CVE-2026-28498: 0.1.0 to 1.6.8 (1.6.9 is outside it) - CVE-2026-28490: 0.1.0 to 1.6.8 (1.6.9 is outside it) - CVE-2026-27962: 0.1.0 to 1.6.8 (1.6.9 is outside it) - CVE-2026-28802: 1.6.5 to 1.6.6 (1.6.7 is outside it) - CVE-2025-68158: 1.0.0 to 1.6.5 (1.6.6 is outside it) - CVE-2025-62706: 0.1.0 to 1.6.4 (1.6.5 is outside it) - CVE-2025-61920: 0.1.0 to 1.6.4 (1.6.5 is outside it) - CVE-2025-59420: 0.1.0 to 1.6.3 (1.6.4 is outside it) - CVE-2024-37568: 0.1.0 to 1.3.0 (1.3.1 is outside it) ## Advisories (21) ### [CVE-2026-116672](https://cve.now/CVE-2026-116672): Authlib RFC 7592 examples omit registration-access-token client binding - Severity: High 8.8 - Published: Oct 27, 2026 - Affected: from 0.15, fixed in 1.9.1. - Fixed in 1.9.1 (released Oct 14, 2026, 13 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-114620](https://cve.now/CVE-2026-114620): Authlib: Unvalidated request\_uri fetch in JWT-secured authorization request (JAR) leading to SSRF - Severity: Medium 5.4 - Published: Oct 22, 2026 - Affected: from 1.6.0, fixed in 1.9.0. - Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-114619](https://cve.now/CVE-2026-114619): Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens - Severity: Medium 4.6 - Published: Oct 22, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-114618](https://cve.now/CVE-2026-114618): Authlib: Default JWT bearer grant accepts assertions for the wrong audience - Severity: Medium 6.8 - Published: Oct 22, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-114617](https://cve.now/CVE-2026-114617): Authlib: ID token can disable its own nonce validation via the nonce\_supported claim - Severity: Medium 4.2 - Published: Oct 22, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-114616](https://cve.now/CVE-2026-114616): Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) - Severity: High 7.4 - Published: Oct 22, 2026 - Affected: fixed in 1.9.1. - Fixed in 1.9.1 (released Oct 14, 2026, 8 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-114615](https://cve.now/CVE-2026-114615): Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys - Severity: High 7.4 - Published: Oct 22, 2026 - Affected: from 1.3.1, fixed in 1.9.0. - Fixed in 1.9.0 (released Oct 14, 2026, 8 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-114614](https://cve.now/CVE-2026-114614): Authlib: is\_secure\_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts - Severity: Low 2.6 - Published: Oct 22, 2026 - Affected: fixed in 1.8.0; from 0.13, fixed in 1.8.0. - Fixed in 1.8.0 (released Aug 30, 2026, 53 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-96760](https://cve.now/CVE-2026-96760): Authlib library contains a signature‑verification bypass vulnerability - Severity: Critical 9.8 - Published: Sep 28, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Oct 14, 2026, 16 days after disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-41479](https://cve.now/CVE-2026-41479): Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect\_uri on unsupported response\_type - Severity: Medium 5.4 - Published: Jun 22, 2026 - Affected: fixed in 1.6.10; from 1.7.0, fixed in 1.7.1. - Fixed in 1.6.10 (released Apr 13, 2026, 70 days before disclosure) and 1.7.1 (released May 4, 2026, 49 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-44681](https://cve.now/CVE-2026-44681): Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization - Severity: Medium 6.1 - Published: May 27, 2026 - Affected: from 1.7.0, fixed in 1.7.1; fixed in 1.6.12. - Fixed in 1.6.12 (released May 4, 2026, 23 days before disclosure) and 1.7.1 (released May 4, 2026, 23 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-41425](https://cve.now/CVE-2026-41425): Authlib: Cross-site request forging when using cache - Severity: Medium 5.4 - Published: Apr 24, 2026 - Affected: fixed in 1.6.11. - Fixed in 1.6.11 (released Apr 16, 2026, 8 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-28498](https://cve.now/CVE-2026-28498): Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding - Severity: High 8.2 - Published: Mar 16, 2026 - Affected: fixed in 1.6.9. - Fixed in 1.6.9 (released Mar 2, 2026, 14 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-28490](https://cve.now/CVE-2026-28490): Authlib Vulnerable to JWE RSA1\_5 Bleichenbacher Padding Oracle - Severity: High 8.3 - Published: Mar 16, 2026 - Affected: fixed in 1.6.9. - Fixed in 1.6.9 (released Mar 2, 2026, 14 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-27962](https://cve.now/CVE-2026-27962): Authlib JWS JWK Header Injection: Signature Verification Bypass - Severity: Critical 9.1 - Published: Mar 16, 2026 - Affected: fixed in 1.6.9. - Fixed in 1.6.9 (released Mar 2, 2026, 14 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2026-28802](https://cve.now/CVE-2026-28802): Authlib: Setting \`alg: none\` and a blank signature appears to bypass signature verification - Severity: High 7.7 - Published: Mar 6, 2026 - Affected: from 1.6.5, fixed in 1.6.7. - Fixed in 1.6.7 (released Feb 6, 2026, 28 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2025-68158](https://cve.now/CVE-2025-68158): Authlib: 1-click Account Takeover - Severity: Medium 5.7 - Published: Jan 8, 2026 - Affected: from 1.0.0, fixed in 1.6.6. - Fixed in 1.6.6 (released Dec 12, 2025, 27 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2025-62706](https://cve.now/CVE-2025-62706): Authlib : JWE zip=DEF decompression bomb enables DoS - Severity: Medium 6.5 - Published: Oct 22, 2025 - Affected: fixed in 1.6.5. - Fixed in 1.6.5 (released Oct 2, 2025, 20 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2025-61920](https://cve.now/CVE-2025-61920): Authlib is vulnerable to Denial of Service via Oversized JOSE Segments - Severity: High 7.5 - Published: Oct 10, 2025 - Affected: fixed in 1.6.5. - Fixed in 1.6.5 (released Oct 2, 2025, 8 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2025-59420](https://cve.now/CVE-2025-59420): Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) - Severity: High 7.5 - Published: Sep 22, 2025 - Affected: fixed in 1.6.4. - Fixed in 1.6.4 (released Sep 17, 2025, 5 days before disclosure). - The latest release, 1.9.5, is not affected. ### [CVE-2024-37568](https://cve.now/CVE-2024-37568): lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. - Severity: High 7.5 - Published: Jun 9, 2024 - Affected: fixed in 1.3.1. - Fixed in 1.3.1 (released Jun 4, 2024, 5 days before disclosure). - The latest release, 1.9.5, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/authlib Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.