authlib kayıtları
authlib üreticisine ait 12 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %100
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-347 Improper Verification of Cryptographic Signature3
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')2
- CWE-352 Cross-Site Request Forgery (CSRF)2
- CWE-203 Observable Discrepancy1
- CWE-20 Improper Input Validation1
- CWE-354 Improper Validation of Integrity Check Value1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
12 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
36İzleyin | CVE-2026-27962İstismar yok | Authlib JWS JWK Header Injection: Signature Verification Bypassauthlib · authlib · CWE-347 | Kritik9,1 | — | %0,5 | 16 Mar 2026 |
35İzleyin | CVE-2025-68158İstismar yok | Authlib: 1-click Account Takeoverauthlib · authlib · CWE-352 | Yüksek8,8 | — | %0,3 | 8 Oca 2026 |
33İzleyin | CVE-2026-28490İstismar yok | Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracleauthlib · authlib · CWE-203 | Yüksek8,3 | — | %0,2 | 16 Mar 2026 |
32İzleyin | CVE-2026-28498İstismar yok | Authlib: Fail-Open Cryptographic Verification in OIDC Hash Bindingauthlib · authlib · CWE-354 | Yüksek8,2 | — | %0,3 | 16 Mar 2026 |
30İzleyin | CVE-2025-61920İstismar yok | Authlib is vulnerable to Denial of Service via Oversized JOSE Segmentsauthlib · authlib · CWE-20 | Yüksek7,5 | — | %0,6 | 10 Eki 2025 |
30İzleyin | CVE-2026-28802İstismar yok | Authlib: Setting `alg: none` and a blank signature appears to bypass signature verificationauthlib · authlib · CWE-347 | Yüksek7,7 | — | %0,5 | 6 Mar 2026 |
30İzleyin | CVE-2024-37568İstismar yok | lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.authlib · authlib · CWE-347 | Yüksek7,5 | — | %0,4 | 9 Haz 2024 |
30İzleyin | CVE-2025-59420İstismar yok | Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)authlib · authlib · CWE-345 | Yüksek7,5 | — | %0,3 | 22 Eyl 2025 |
26İzleyin | CVE-2025-62706İstismar yok | Authlib : JWE zip=DEF decompression bomb enables DoSauthlib · authlib · CWE-400 | Orta6,5 | — | %0,5 | 22 Eki 2025 |
24İzleyin | CVE-2026-44681İstismar yok | Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorizationauthlib · authlib · CWE-601 | Orta6,1 | — | %0,3 | 27 May 2026 |
21İzleyin | CVE-2026-41479İstismar yok | Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_typeauthlib · authlib · CWE-601 | Orta5,4 | — | %0,3 | 22 Haz 2026 |
21İzleyin | CVE-2026-41425İstismar yok | Authlib: Cross-site request forging when using cacheauthlib · authlib · CWE-352 | Orta5,4 | — | %0,1 | 24 Nis 2026 |
- CVE-2026-2796236İzleyin
Authlib JWS JWK Header Injection: Signature Verification Bypass
KritikCVSS 9,1İstismar yokEPSS %1authlib · authlib16 Mar 2026
- CVE-2025-6815835İzleyin
Authlib: 1-click Account Takeover
YüksekCVSS 8,8İstismar yokEPSS %0authlib · authlib8 Oca 2026
- CVE-2026-2849033İzleyin
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
YüksekCVSS 8,3İstismar yokEPSS %0authlib · authlib16 Mar 2026
- CVE-2026-2849832İzleyin
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
YüksekCVSS 8,2İstismar yokEPSS %0authlib · authlib16 Mar 2026
- CVE-2025-6192030İzleyin
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
YüksekCVSS 7,5İstismar yokEPSS %1authlib · authlib10 Eki 2025
- CVE-2026-2880230İzleyin
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
YüksekCVSS 7,7İstismar yokEPSS %1authlib · authlib6 Mar 2026
- CVE-2024-3756830İzleyin
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.
YüksekCVSS 7,5İstismar yokEPSS %0authlib · authlib9 Haz 2024
- CVE-2025-5942030İzleyin
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
YüksekCVSS 7,5İstismar yokEPSS %0authlib · authlib22 Eyl 2025
- CVE-2025-6270626İzleyin
Authlib : JWE zip=DEF decompression bomb enables DoS
OrtaCVSS 6,5İstismar yokEPSS %0authlib · authlib22 Eki 2025
- CVE-2026-4468124İzleyin
Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization
OrtaCVSS 6,1İstismar yokEPSS %0authlib · authlib27 May 2026
- CVE-2026-4147921İzleyin
Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type
OrtaCVSS 5,4İstismar yokEPSS %0authlib · authlib22 Haz 2026
- CVE-2026-4142521İzleyin
Authlib: Cross-site request forging when using cache
OrtaCVSS 5,4İstismar yokEPSS %0authlib · authlib24 Nis 2026