Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

Authlib is a Python library which builds OAuth and OpenID Connect servers

Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

Authlib: Cross-site request forging when using cache

Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Authlib: ID token can disable its own nonce validation via the nonce_supported claim