What’s Vulnerable › Vulnerabilities

CVE-2025-61920: Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-10 · updated 2026-10-19
• Weakness: CWE-20

Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.

Affected products

• authlib: before 1.6.5 — fixed in 1.6.5

How to fix

Upgrade to a fixed version: authlib 1.6.5. Check the vendor advisory for mitigations.

References

• https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e
• https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9
• https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html

Get alerted when CVE-2025-61920 or the next vulnerability affects your stack