AU
Product
authlib
22
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 4High 8Medium 9Low 1
Watch
Add authlib to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-104056 | 9.8 | Oct 1 | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding Affected: 1.7.2 |
| CVE-2026-96760 | 9.8 | Sep 28 | Authlib library contains a signature‑verification bypass vulnerability Affected: 1.7.2 |
| CVE-2026-28802 | 9.8 | Mar 6 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: 1.6.5 before 1.6.7 |
| CVE-2026-27962 | 9.1 | Mar 16 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.9 |
| CVE-2026-116672 New | 8.8 | Oct 27 | Authlib RFC 7592 examples omit registration-access-token client binding Affected: >= 0.15, < 1.9.1 |
| CVE-2025-68158 | 8.8 | Jan 8 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.6 |
| CVE-2026-28498 | 7.5 | Mar 16 | Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding Affected: < 1.6.9 |
| CVE-2025-61920 | 7.5 | Oct 10 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.5 |
| CVE-2025-59420 | 7.5 | Sep 22 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.4 |
| CVE-2024-37568 | 7.5 | Jun 9 | lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys Affected: before 1.3.1 |
| CVE-2026-114616 New | 7.4 | Oct 22 | Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) Affected: < 1.9.1 |
| CVE-2026-114615 New | 7.4 | Oct 22 | Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys Affected: >= 1.3.1, < 1.9.0 |
| CVE-2026-114618 New | 6.8 | Oct 22 | Authlib: Default JWT bearer grant accepts assertions for the wrong audience Affected: < 1.9.0 |
| CVE-2026-28490 | 6.5 | Mar 16 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.9 |
| CVE-2025-62706 | 6.5 | Oct 22 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.5 |
| CVE-2026-44681 | 6.1 | May 27 | Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization Affected: < 1.6.12; >= 1.7.0, < 1.7.1 |
| CVE-2026-114620 New | 5.4 | Oct 22 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF Affected: < 1.9.0 |
| CVE-2026-41479 | 5.4 | Jun 22 | Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type Affected: < 1.6.10; = 1.7.0 |
| CVE-2026-41425 | 5.4 | Apr 24 | Authlib: Cross-site request forging when using cache Affected: < 1.6.11 |
| CVE-2026-114619 New | 4.6 | Oct 22 | Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens Affected: < 1.9.0 |
| CVE-2026-114617 New | 4.2 | Oct 22 | Authlib: ID token can disable its own nonce validation via the nonce_supported claim Affected: < 1.9.0 |
| CVE-2026-114614 New | 2.6 | Oct 22 | Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts Affected: < 1.8.0 |
Showing 22