What’s Vulnerable › Products
authlib vulnerabilities
22 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.
Check whether your authlib version is affected
Latest authlib vulnerabilities
- CVE-2026-116672 — Authlib RFC 7592 examples omit registration-access-token client binding (CVSS 8.8)
- CVE-2026-114620 — Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF (CVSS 5.4)
- CVE-2026-114619 — Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens (CVSS 4.6)
- CVE-2026-114618 — Authlib: Default JWT bearer grant accepts assertions for the wrong audience (CVSS 6.8)
- CVE-2026-114617 — Authlib: ID token can disable its own nonce validation via the nonce_supported claim (CVSS 4.2)
- CVE-2026-114614 — Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts (CVSS 2.6)
- CVE-2026-114616 — Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) (CVSS 7.4)
- CVE-2026-114615 — Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys (CVSS 7.4)
- CVE-2026-104056 — CVE-2026-104056 (CVSS 9.8)
- CVE-2026-96760 — Authlib library contains a signature‑verification bypass vulnerability (CVSS 9.8)
- CVE-2026-41479 — Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type (CVSS 5.4)
- CVE-2026-44681 — Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization (CVSS 6.1)
- CVE-2026-41425 — Authlib: Cross-site request forging when using cache (CVSS 5.4)
- CVE-2026-28498 — Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding (CVSS 7.5)
- CVE-2026-28490 — Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle (CVSS 6.5)
- CVE-2026-27962 — Authlib JWS JWK Header Injection: Signature Verification Bypass (CVSS 9.1)
- CVE-2026-28802 — Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification (CVSS 9.8)
- CVE-2025-68158 — Authlib: 1-click Account Takeover (CVSS 8.8)
- CVE-2025-62706 — Authlib : JWE zip=DEF decompression bomb enables DoS (CVSS 6.5)
- CVE-2025-61920 — Authlib is vulnerable to Denial of Service via Oversized JOSE Segments (CVSS 7.5)
- CVE-2025-59420 — Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) (CVSS 7.5)
- CVE-2024-37568 — (CVSS 7.5)