Authlib vulnerabilities
30 CVEs and advisories name Authlib as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119284joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
- CVE-2026-119283joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption
- CVE-2026-116672Authlib RFC 7592 examples omit registration-access-token client binding
- CVE-2026-114620Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
- CVE-2026-114619Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
- CVE-2026-114618Authlib: Default JWT bearer grant accepts assertions for the wrong audience
- CVE-2026-114617Authlib: ID token can disable its own nonce validation via the nonce_supported claim
- CVE-2026-114616Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
- CVE-2026-114615Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
- CVE-2026-114614Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
- CVE-2026-102946joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json
- CVE-2026-104056CVE-2026-104056
- CVE-2026-96760Authlib library contains a signature‑verification bypass vulnerability
- CVE-2026-75509joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
- CVE-2026-62995joserfc accepts JWT with padding, leading to JWT malleability
- CVE-2026-49852joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
- CVE-2026-41479Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type
- CVE-2026-48990joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
- CVE-2026-44681Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization
- CVE-2026-41425Authlib: Cross-site request forging when using cache
- CVE-2026-28498Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28490Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-27962Authlib JWS JWK Header Injection: Signature Verification Bypass
- CVE-2026-28802Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2026-27932joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)
- CVE-2025-68158Authlib: 1-click Account Takeover
- CVE-2025-65015joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
- CVE-2025-62706Authlib : JWE zip=DEF decompression bomb enables DoS
- CVE-2025-61920Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
- CVE-2025-59420Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)