AU
Vendor
authlib
27
CVEs
0
On KEV
11
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116672 New | AU authlib authlib | 8.8 | Oct 27 | Authlib RFC 7592 examples omit registration-access-token client binding |
| CVE-2026-114620 New | AU authlib authlib | 5.4 | Oct 22 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF |
| CVE-2026-114619 New | AU authlib authlib | 4.6 | Oct 22 | Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens |
| CVE-2026-114618 New | AU authlib authlib | 6.8 | Oct 22 | Authlib: Default JWT bearer grant accepts assertions for the wrong audience |
| CVE-2026-114617 New | AU authlib authlib | 4.2 | Oct 22 | Authlib: ID token can disable its own nonce validation via the nonce_supported claim |
| CVE-2026-114616 New | AU authlib authlib | 7.4 | Oct 22 | Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) |
| CVE-2026-114615 New | AU authlib authlib | 7.4 | Oct 22 | Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys |
| CVE-2026-114614 New | AU authlib authlib | 2.6 | Oct 22 | Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts |
| CVE-2026-102946 | JO joserfc authlib | 9.1 | Oct 15 | joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json |
| CVE-2026-104056 | AU Authlib Authlib | 9.8 | Oct 1 | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding |
| CVE-2026-96760 | AU Authlib Authlib | 9.8 | Sep 28 | Authlib library contains a signature‑verification bypass vulnerability |
| CVE-2026-75509 | JO joserfc authlib | 6.5 | Aug 24 | joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti) |
| CVE-2026-62995 | JO joserfc authlib | 2.3 | Jul 29 | joserfc accepts JWT with padding, leading to JWT malleability |
| CVE-2026-49852 | JO joserfc authlib | 8.7 | Jul 17 | joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) |
| CVE-2026-41479 | AU authlib authlib | 5.4 | Jun 22 | Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type |
| CVE-2026-48990 | JO joserfc authlib | 5.3 | Jun 17 | joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization |
| CVE-2026-44681 | AU authlib authlib | 6.1 | May 27 | Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization |
| CVE-2026-41425 | AU authlib authlib | 5.4 | Apr 24 | Authlib: Cross-site request forging when using cache |
| CVE-2026-28498 | AU authlib authlib | 7.5 | Mar 16 | Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding |
| CVE-2026-28490 | AU authlib authlib | 6.5 | Mar 16 | Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle |
| CVE-2026-27962 | AU authlib authlib | 9.1 | Mar 16 | Authlib JWS JWK Header Injection: Signature Verification Bypass |
| CVE-2026-28802 | AU authlib authlib | 9.8 | Mar 6 | Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification |
| CVE-2025-68158 | AU Authlib Authlib | 8.8 | Jan 8 | Authlib is a Python library which builds OAuth and OpenID Connect servers |
| CVE-2025-62706 | AU Authlib Authlib | 6.5 | Oct 22 | Authlib is a Python library which builds OAuth and OpenID Connect servers |
| CVE-2025-61920 | AU Authlib Authlib | 7.5 | Oct 10 | Authlib is a Python library which builds OAuth and OpenID Connect servers |
| CVE-2025-59420 | AU Authlib Authlib | 7.5 | Sep 22 | Authlib is a Python library which builds OAuth and OpenID Connect servers |
| CVE-2024-37568 | AU Authlib Authlib | 7.5 | Jun 9 | lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys |