authlib vulnerabilities

CVEs per yearBy the year they were published

1. 20254
2. 202626

Newest CVEs

• CVE-2026-119284

  joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection

  authlib · joserfc

  Medium6.9
• CVE-2026-119283

  joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

  authlib · joserfc

  High7.5
• CVE-2026-116672

  Authlib RFC 7592 examples omit registration-access-token client binding

  authlib · authlib

  High8.8
• CVE-2026-114620

  Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

  authlib · authlib

  Medium5.4
• CVE-2026-114619

  Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

  authlib · authlib

  Medium4.6
• CVE-2026-114618

  Authlib: Default JWT bearer grant accepts assertions for the wrong audience

  authlib · authlib

  Medium6.8
• CVE-2026-114617

  Authlib: ID token can disable its own nonce validation via the nonce_supported claim

  authlib · authlib

  Medium4.2
• CVE-2026-114616

  Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

  authlib · authlib

  High7.4
• CVE-2026-114615

  Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

  authlib · authlib

  High7.4
• CVE-2026-114614

  Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

  authlib · authlib

  Low2.6