Vulnerabilities in authlib
30 resultsCVE-2026-114615HIGHAuthlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysEPSS 0.2%CVE-2026-104056CRITICALCVE-2026-104056EPSS 0.2%CVE-2026-119284MEDIUMjoserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionEPSS 0.2%CVE-2026-49852HIGHjoserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)EPSS 0.2%CVE-2026-114619MEDIUMAuthlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensEPSS 0.2%CVE-2026-62995LOWjoserfc accepts JWT with padding, leading to JWT malleabilityEPSS 0.1%CVE-2026-28490HIGHAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding OracleEPSS 0.1%CVE-2026-75509MEDIUMjoserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)EPSS 0.1%CVE-2026-102946CRITICALjoserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_jsonEPSS 0.1%CVE-2026-41425MEDIUMAuthlib: Cross-site request forging when using cacheEPSS 0.1%