AU
Product
authlib
22
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 4High 8Medium 9Low 1
Watch
Add authlib to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-104056 | 9.8 | Oct 1 | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding Affected: 1.7.2 |
| CVE-2026-96760 | 9.8 | Sep 28 | Authlib library contains a signature‑verification bypass vulnerability Affected: 1.7.2 |
| CVE-2026-28802 | 9.8 | Mar 6 | Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification Affected: >= 1.6.5, < 1.6.7 |
| CVE-2026-27962 | 9.1 | Mar 16 | Authlib JWS JWK Header Injection: Signature Verification Bypass Affected: < 1.6.9 |
Showing 4