# cve.now: Authlib

The newest entries naming Authlib as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119284](https://cve.now/CVE-2026-119284.md): joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection (CVSS 6.9)
- [CVE-2026-119283](https://cve.now/CVE-2026-119283.md): joserfc: Unbounded JWE General JSON \`recipients\` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption (CVSS 7.5)
- [CVE-2026-116672](https://cve.now/CVE-2026-116672.md): Authlib RFC 7592 examples omit registration-access-token client binding (CVSS 8.8)
- [CVE-2026-114620](https://cve.now/CVE-2026-114620.md): Authlib: Unvalidated request\_uri fetch in JWT-secured authorization request (JAR) leading to SSRF (CVSS 5.4)
- [CVE-2026-114619](https://cve.now/CVE-2026-114619.md): Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens (CVSS 4.6)
- [CVE-2026-114618](https://cve.now/CVE-2026-114618.md): Authlib: Default JWT bearer grant accepts assertions for the wrong audience (CVSS 6.8)
- [CVE-2026-114617](https://cve.now/CVE-2026-114617.md): Authlib: ID token can disable its own nonce validation via the nonce\_supported claim (CVSS 4.2)
- [CVE-2026-114616](https://cve.now/CVE-2026-114616.md): Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) (CVSS 7.4)
- [CVE-2026-114615](https://cve.now/CVE-2026-114615.md): Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys (CVSS 7.4)
- [CVE-2026-114614](https://cve.now/CVE-2026-114614.md): Authlib: is\_secure\_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts (CVSS 2.6)
- [CVE-2026-102946](https://cve.now/CVE-2026-102946.md): joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize\_json (CVSS 9.1)
- [CVE-2026-104056](https://cve.now/CVE-2026-104056.md): CVE-2026-104056 (CVSS 9.8)
- [CVE-2026-96760](https://cve.now/CVE-2026-96760.md): Authlib library contains a signature‑verification bypass vulnerability (CVSS 9.8)
- [CVE-2026-75509](https://cve.now/CVE-2026-75509.md): joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) (CVSS 6.5)
- [CVE-2026-62995](https://cve.now/CVE-2026-62995.md): joserfc accepts JWT with padding, leading to JWT malleability (CVSS 2.3)
- [CVE-2026-49852](https://cve.now/CVE-2026-49852.md): joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) (CVSS 8.7)
- [CVE-2026-41479](https://cve.now/CVE-2026-41479.md): Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect\_uri on unsupported response\_type (CVSS 5.4)
- [CVE-2026-48990](https://cve.now/CVE-2026-48990.md): joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization (CVSS 5.3)
- [CVE-2026-44681](https://cve.now/CVE-2026-44681.md): Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization (CVSS 6.1)
- [CVE-2026-41425](https://cve.now/CVE-2026-41425.md): Authlib: Cross-site request forging when using cache (CVSS 5.4)
- [CVE-2026-28498](https://cve.now/CVE-2026-28498.md): Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding (CVSS 8.2)
- [CVE-2026-28490](https://cve.now/CVE-2026-28490.md): Authlib Vulnerable to JWE RSA1\_5 Bleichenbacher Padding Oracle (CVSS 8.3)
- [CVE-2026-27962](https://cve.now/CVE-2026-27962.md): Authlib JWS JWK Header Injection: Signature Verification Bypass (CVSS 9.1)
- [CVE-2026-28802](https://cve.now/CVE-2026-28802.md): Authlib: Setting \`alg: none\` and a blank signature appears to bypass signature verification (CVSS 7.7)
- [CVE-2026-27932](https://cve.now/CVE-2026-27932.md): joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS) (CVSS 7.5)
- [CVE-2025-68158](https://cve.now/CVE-2025-68158.md): Authlib: 1-click Account Takeover (CVSS 5.7)
- [CVE-2025-65015](https://cve.now/CVE-2025-65015.md): joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads (CVSS 9.2)
- [CVE-2025-62706](https://cve.now/CVE-2025-62706.md): Authlib : JWE zip=DEF decompression bomb enables DoS (CVSS 6.5)
- [CVE-2025-61920](https://cve.now/CVE-2025-61920.md): Authlib is vulnerable to Denial of Service via Oversized JOSE Segments (CVSS 7.5)
- [CVE-2025-59420](https://cve.now/CVE-2025-59420.md): Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/authlib
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.