CVE-2025-62706
- EPSS 0.08%
- Veröffentlicht 22.10.2025 21:31:10
- Zuletzt bearbeitet 03.11.2025 18:17:02
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, ...
CVE-2025-61920
- EPSS 0.38%
- Veröffentlicht 10.10.2025 19:25:07
- Zuletzt bearbeitet 03.11.2025 18:17:01
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded head...
CVE-2025-59420
- EPSS 0.03%
- Veröffentlicht 22.09.2025 17:28:53
- Zuletzt bearbeitet 03.11.2025 18:17:01
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An at...
CVE-2024-37568
- EPSS 0.16%
- Veröffentlicht 09.06.2024 19:15:52
- Zuletzt bearbeitet 03.11.2025 18:15:42
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-3366...