AU
Product
authlib
22
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 4High 8Medium 9Low 1
Watch
Add authlib to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116672 New | 8.8 | Oct 27 | Authlib RFC 7592 examples omit registration-access-token client binding Affected: >= 0.15, < 1.9.1 |
| CVE-2025-68158 | 8.8 | Jan 8 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.6 |
| CVE-2026-28498 | 7.5 | Mar 16 | Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding Affected: < 1.6.9 |
| CVE-2025-61920 | 7.5 | Oct 10 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.5 |
| CVE-2025-59420 | 7.5 | Sep 22 | Authlib is a Python library which builds OAuth and OpenID Connect servers Affected: before 1.6.4 |
| CVE-2024-37568 | 7.5 | Jun 9 | lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys Affected: before 1.3.1 |
| CVE-2026-114616 New | 7.4 | Oct 22 | Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) Affected: < 1.9.1 |
| CVE-2026-114615 New | 7.4 | Oct 22 | Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys Affected: >= 1.3.1, < 1.9.0 |
Showing 8