python-authlib - security update

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2024-37568

  Authlib has algorithm confusion with asymmetric public keys

  lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)

  python-authlib python-authlib authlib Debian Ubuntu PyPI
  Jun 9, 2024
• High 7.5
  CVE-2025-59420

  Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

  Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker ca…

  authlib authlib open-webui python-authlib Debian Ubuntu Wolfi PyPI
  Sep 22, 2025
• High 7.5
  CVE-2025-61920

  Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

  Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or sig…

  authlib authlib python-authlib python-authlib Debian Ubuntu PyPI
  Oct 10, 2025
• Medium 6.5
  CVE-2025-62706

  Authlib : JWE zip=DEF decompression bomb enables DoS

  Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing …

  authlib authlib python-authlib python-authlib Debian Ubuntu PyPI
  Oct 22, 2025