authlib vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-116672HighAuthlib: Authlib RFC 7592 examples omit registration-access-token client bindingCVE-2026-114616HighAuthlib: Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)CVE-2026-114620Mediumauthlib: Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFCVE-2026-114617Mediumauthlib: Authlib: ID token can disable its own nonce validation via the nonce_supported claimCVE-2026-114618Mediumauthlib: Authlib: Default JWT bearer grant accepts assertions for the wrong audienceCVE-2026-114619Mediumauthlib: Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensCVE-2026-114615Highauthlib: Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysCVE-2026-114614Lowauthlib: Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…CVE-2026-96760Criticalauthlib: Authlib: empty signatures validation in JWS JSON deserializationCVE-2026-41479Mediumauthlib: Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_typeCVE-2026-44681Mediumauthlib: Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open RedirectCVE-2026-41425Mediumauthlib: Authlib: Cross-site request forging when using cacheCVE-2026-28498Highauthlib: Authlib: Fail-Open Cryptographic Verification in OIDC Hash BindingCVE-2026-28490Highauthlib: Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding OracleCVE-2026-27962Criticalauthlib: Authlib JWS JWK Header Injection: Signature Verification BypassCVE-2026-28802Highauthlib: Authlib: Setting `alg: none` and a blank signature appears to bypass signature verificationCVE-2025-68158Mediumauthlib: Authlib has 1-click Account Takeover vulnerabilityCVE-2025-62706Mediumauthlib: Authlib : JWE zip=DEF decompression bomb enables DoSCVE-2025-61920Highauthlib: Authlib is vulnerable to Denial of Service via Oversized JOSE SegmentsCVE-2025-59420Highauthlib: Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)CVE-2024-37568Highauthlib: Authlib has algorithm confusion with asymmetric public keys

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo