HIGH7.4PyPI
GHSA-5357-c2jx-v7qh· CVE-2024-37568, PYSEC-2024-52Authlib has algorithm confusion with asymmetric public keys
Modified: 11/3/2025
package
PyPI/authlib
pkg:pypi/authlib
HIGHPyPI
GHSA-7432-952r-cw78· CVE-2026-28490, PYSEC-2026-2116Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
Modified: 7/13/2026
HIGHPyPI
GHSA-7wc2-qxgw-g8gg· CVE-2026-28802, PYSEC-2026-2118Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-9ggr-2464-2j32· CVE-2025-59420, PYSEC-2026-1200Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Modified: 9/10/2026
MEDIUM5.7PyPI
GHSA-fg6f-75jq-6523· CVE-2025-68158, PYSEC-2026-1201Authlib has 1-click Account Takeover vulnerability
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-g7f3-828f-7h7m· CVE-2025-62706, PYSEC-2026-1202Authlib : JWE zip=DEF decompression bomb enables DoS
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-jj8c-mmj3-mmgv· CVE-2026-41425, PYSEC-2026-25Authlib: Cross-site request forging when using cache
Modified: 9/10/2026
HIGHPyPI
GHSA-m344-f55w-2m6j· CVE-2026-28498, PYSEC-2026-2117Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Modified: 7/13/2026
HIGH7.5PyPI
GHSA-pq5p-34cr-23v9· CVE-2025-61920, PYSEC-2026-1203Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Modified: 9/10/2026
MEDIUM6.1PyPI
GHSA-r95x-qfjj-fjj2· CVE-2026-44681, PYSEC-2026-188Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect
Modified: 9/10/2026
MEDIUM5.4PyPI
GHSA-w8p2-r796-3vmq· CVE-2026-41479, PYSEC-2026-2119Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
Modified: 7/18/2026
CRITICAL9.1PyPI
GHSA-wvwj-cvrp-7pv5· CVE-2026-27962, PYSEC-2026-287Authlib JWS JWK Header Injection: Signature Verification Bypass
Modified: 6/29/2026
—PyPI
PYSEC-2024-52· CVE-2024-37568, GHSA-5357-c2jx-v7qhModified: 6/10/2026
HIGH7.5PyPI
PYSEC-2026-1200· CVE-2025-59420, GHSA-9ggr-2464-2j32Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Modified: 7/7/2026
MEDIUM5.7PyPI
PYSEC-2026-1201· CVE-2025-68158, GHSA-fg6f-75jq-6523Authlib has 1-click Account Takeover vulnerability
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1202· CVE-2025-62706, GHSA-g7f3-828f-7h7mAuthlib : JWE zip=DEF decompression bomb enables DoS
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1203· CVE-2025-61920, GHSA-pq5p-34cr-23v9Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-188· CVE-2026-44681, GHSA-r95x-qfjj-fjj2Modified: 6/3/2026
MEDIUM6.5PyPI
PYSEC-2026-2116· CVE-2026-28490, GHSA-7432-952r-cw78Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2117· CVE-2026-28498, GHSA-m344-f55w-2m6jModified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-2118· CVE-2026-28802, GHSA-7wc2-qxgw-g8ggModified: 7/13/2026
MEDIUM5.4PyPI
PYSEC-2026-2119· CVE-2026-41479, GHSA-w8p2-r796-3vmqModified: 7/13/2026
MEDIUM5.4PyPI
PYSEC-2026-25· CVE-2026-41425, GHSA-jj8c-mmj3-mmgvModified: 5/20/2026
CRITICAL9.1PyPI
PYSEC-2026-287· CVE-2026-27962, GHSA-wvwj-cvrp-7pv5Authlib JWS JWK Header Injection: Signature Verification Bypass
Modified: 7/13/2026