Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-f8jg-a3bd-x7ax

Summary

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (`crit`), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, `bork` or `cnf`) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation.

Aliases

alias	CVE-2025-59420

alias	GHSA-9ggr-2464-2j32

Fixed_packages

url pkg:pypi/authlib@1.6.4

purl pkg:pypi/authlib@1.6.4

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-hrf7-xz6n-efcg

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/authlib@1.6.4

Affected_packages

References

reference_url	https://github.com/authlib/authlib
reference_id
reference_type
scores
url	https://github.com/authlib/authlib

reference_url	https://github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479df
reference_id
reference_type
scores
url	https://github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479df

reference_url	https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html
reference_id
reference_type
scores
url	https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2025-59420
reference_id	CVE-2025-59420
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2025-59420

reference_url	https://github.com/advisories/GHSA-9ggr-2464-2j32
reference_id	GHSA-9ggr-2464-2j32
reference_type
scores
url	https://github.com/advisories/GHSA-9ggr-2464-2j32

reference_url	https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32
reference_id	GHSA-9ggr-2464-2j32
reference_type
scores
url	https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32

Weaknesses

cwe_id	345
name	Insufficient Verification of Data Authenticity
description	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

cwe_id	863
name	Incorrect Authorization
description	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f8jg-a3bd-x7ax

Vulnerability Instance