authlib records

12 published records for vendor authlib.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

12 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-27962No exploit	Authlib JWS JWK Header Injection: Signature Verification Bypassauthlib · authlib · CWE-347 Pre-auth Auth bypass Deserialization	Critical9.1	—	0.5%	Mar 16, 2026
35Monitor	CVE-2025-68158No exploit	Authlib: 1-click Account Takeoverauthlib · authlib · CWE-352 Pre-auth CSRF	High8.8	—	0.3%	Jan 8, 2026
33Monitor	CVE-2026-28490No exploit	Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracleauthlib · authlib · CWE-203 Pre-auth	High8.3	—	0.2%	Mar 16, 2026
32Monitor	CVE-2026-28498No exploit	Authlib: Fail-Open Cryptographic Verification in OIDC Hash Bindingauthlib · authlib · CWE-354 Pre-auth	High8.2	—	0.3%	Mar 16, 2026
30Monitor	CVE-2025-61920No exploit	Authlib is vulnerable to Denial of Service via Oversized JOSE Segmentsauthlib · authlib · CWE-20 Pre-auth Denial of service	High7.5	—	0.6%	Oct 10, 2025
30Monitor	CVE-2026-28802No exploit	Authlib: Setting `alg: none` and a blank signature appears to bypass signature verificationauthlib · authlib · CWE-347 Pre-auth Weak crypto	High7.7	—	0.5%	Mar 6, 2026
30Monitor	CVE-2024-37568No exploit	lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.authlib · authlib · CWE-347 Pre-auth Weak crypto	High7.5	—	0.4%	Jun 9, 2024
30Monitor	CVE-2025-59420No exploit	Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)authlib · authlib · CWE-345 Pre-auth	High7.5	—	0.3%	Sep 22, 2025
26Monitor	CVE-2025-62706No exploit	Authlib : JWE zip=DEF decompression bomb enables DoSauthlib · authlib · CWE-400 Denial of service	Medium6.5	—	0.5%	Oct 22, 2025
24Monitor	CVE-2026-44681No exploit	Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorizationauthlib · authlib · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.3%	May 27, 2026
21Monitor	CVE-2026-41479No exploit	Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_typeauthlib · authlib · CWE-601 Pre-auth Open redirect	Medium5.4	—	0.3%	Jun 22, 2026
21Monitor	CVE-2026-41425No exploit	Authlib: Cross-site request forging when using cacheauthlib · authlib · CWE-352 Pre-auth CSRF	Medium5.4	—	0.1%	Apr 24, 2026

CVE-2026-27962
36Monitor
Authlib JWS JWK Header Injection: Signature Verification Bypass
CriticalCVSS 9.1No exploitEPSS 1%
authlib · authlibMar 16, 2026
CVE-2025-68158
35Monitor
Authlib: 1-click Account Takeover
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
authlib · authlibJan 8, 2026
CVE-2026-28490
33Monitor
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
authlib · authlibMar 16, 2026
CVE-2026-28498
32Monitor
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
authlib · authlibMar 16, 2026
CVE-2025-61920
30Monitor
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
authlib · authlibOct 10, 2025
CVE-2026-28802
30Monitor
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
HighCVSS 7.7No exploitEPSS 1%
- Pre-auth
- Weak crypto
authlib · authlibMar 6, 2026
CVE-2024-37568
30Monitor
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
authlib · authlibJun 9, 2024
CVE-2025-59420
30Monitor
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
authlib · authlibSep 22, 2025
CVE-2025-62706
26Monitor
Authlib : JWE zip=DEF decompression bomb enables DoS
MediumCVSS 6.5No exploitEPSS 0%
- Denial of service
authlib · authlibOct 22, 2025
CVE-2026-44681
24Monitor
Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- Open redirect
authlib · authlibMay 27, 2026
CVE-2026-41479
21Monitor
Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type
MediumCVSS 5.4No exploitEPSS 0%
- Pre-auth
- Open redirect
authlib · authlibJun 22, 2026
CVE-2026-41425
21Monitor
Authlib: Cross-site request forging when using cache
MediumCVSS 5.4No exploitEPSS 0%
- Pre-auth
- CSRF
authlib · authlibApr 24, 2026