authlib
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 32 advisory(ies) without a verdict
Advisories (32)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-5357-c2jx-v7qh Authlib has algorithm confusion with asymmetric public keys | < 1.3.1 | Undetermined |
| GHSA-6v38-4h7w-rj9h Authlib: empty signatures validation in JWS JSON deserialization | < 1.9.0 | Undetermined |
| GHSA-7432-952r-cw78 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle | < 1.6.9 | Undetermined |
| GHSA-7vr2-2fgp-9w7p Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys | 1.3.1 – < 1.9.0 | Undetermined |
| GHSA-7wc2-qxgw-g8gg Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification | 1.6.5 – < 1.6.7 | Undetermined |
| GHSA-8m4g-j4wp-wgcg Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) | < 1.9.1 | Undetermined |
| GHSA-9ggr-2464-2j32 Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) | < 1.6.4 | Undetermined |
| GHSA-c5mf-xmp2-59rc Authlib: ID token can disable its own nonce validation via the nonce_supported claim | < 1.9.0 | Undetermined |
| GHSA-fch4-3c6x-j4gc Authlib: Default JWT bearer grant accepts assertions for the wrong audience | < 1.9.0 | Undetermined |
| GHSA-fg6f-75jq-6523 Authlib has 1-click Account Takeover vulnerability | 1.0.0 – < 1.6.6 | Undetermined |
| GHSA-g7f3-828f-7h7m Authlib : JWE zip=DEF decompression bomb enables DoS | < 1.6.5 | Undetermined |
| GHSA-jj7h-c3hg-m23x Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts | < 1.8.0 | Undetermined |
| GHSA-jj8c-mmj3-mmgv Authlib: Cross-site request forging when using cache | < 1.6.11 | Undetermined |
| GHSA-m344-f55w-2m6j Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding | < 1.6.9 | Undetermined |
| GHSA-pq5p-34cr-23v9 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments | < 1.6.5 | Undetermined |
| GHSA-q686-2qmg-hqc7 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens | < 1.9.0 | Undetermined |
| GHSA-r95x-qfjj-fjj2 Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect | 1.7.0 – < 1.7.1 ; < 1.6.12 | Undetermined |
| GHSA-w8p2-r796-3vmq Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type | < 1.6.10 ; 1.7.0 – < 1.7.1 | Undetermined |
| GHSA-wvwj-cvrp-7pv5 Authlib JWS JWK Header Injection: Signature Verification Bypass | < 1.6.9 | Undetermined |
| GHSA-x4rv-c3wx-4cr8 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF | 1.6.0 – < 1.9.0 | Undetermined |
| PYSEC-2024-52 lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is al | < 1.3.1 | Undetermined |
| PYSEC-2026-1200 Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) | < 1.6.4 | Undetermined |
| PYSEC-2026-1201 Authlib has 1-click Account Takeover vulnerability | 1.0.0 – < 1.6.6 | Undetermined |
| PYSEC-2026-1202 Authlib : JWE zip=DEF decompression bomb enables DoS | < 1.6.5 | Undetermined |
| PYSEC-2026-1203 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments | < 1.6.5 | Undetermined |
| PYSEC-2026-188 Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplic | < 1.6.12 | Undetermined |
| PYSEC-2026-2116 Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified i | < 1.6.9 | Undetermined |
| PYSEC-2026-2117 Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib P | < 1.6.9 | Undetermined |
| PYSEC-2026-2118 Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malici | 1.6.5 – < 1.6.7 | Undetermined |
| PYSEC-2026-2119 Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned i | < 1.6.10 | Undetermined |
| PYSEC-2026-25 Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrat | < 1.6.11 | Undetermined |
| PYSEC-2026-287 Authlib JWS JWK Header Injection: Signature Verification Bypass | < 1.6.9 | Undetermined |
Withdrawn advisories (1)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-6m87-8wg6-hh8w Duplicate Advisory: Authlib: empty signatures validation in JWS JSON deserialization · withdrawn
Sources
| Source | Licence |
|---|