Login Request a demo
High severity · published Jun 9, 2024
CVE-2024-37568
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Authlib · Authlib
before 1.3.1 · source: NVD
Affected product
AU
Authlib
Authlib
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37568
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37568
Exploit
https://github.com/lepture/authlib/issues/654
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHJI32SN4FNAUVNALVGOKWHNSQ6XS3M5/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU/
www.vicarius.io
https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-lepture-authlib-cve-2024-37568
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html
More from Authlib
9.8
CVE-2026-104056
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding
9.8
CVE-2026-96760
Authlib library contains a signature‑verification bypass vulnerability
9.8
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
9.1
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
8.8
CVE-2026-116672
Authlib RFC 7592 examples omit registration-access-token client binding