Skip to content
OpenAdvisories

Vendor

authlib

30 known vulnerabilities.

Products

authlib 21 joserfc 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.6
    CVE-2026-114614

    Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

    Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host …

    authlib authlib python-authlib python-authlib Debian Ubuntu PyPI
  • Low 2.3
    CVE-2026-62995

    joserfc accepts JWT with padding, leading to JWT malleability

    joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding (==) which are not conforming to the JOSE specifications. This …

    authlib joserfc joserfc joserfc Debian Ubuntu