Skip to content
OpenAdvisories

Package · Debian

python-authlib

22 known vulnerabilities.

All Critical High Medium Low Exploited only

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-104056

    CVE-2026-104056

    Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than …

    authlib authlib python-authlib python-authlib Debian Ubuntu
  • Critical 9.8
    CVE-2026-96760

    Authlib library contains a signature‑verification bypass vulnerability

    Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and wit…

    authlib authlib python-authlib python-authlib Debian Ubuntu PyPI
  • Critical 9.1
    CVE-2026-27962

    Authlib JWS JWK Header Injection: Signature Verification Bypass

    Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verifi…

    authlib authlib python-authlib python-authlib Debian Ubuntu PyPI