Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/python-authlib@1.7.2-1
purl pkg:deb/debian/python-authlib@1.7.2-1
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (6)
Vulnerability Summary Aliases
VCID-4wgd-2mpe-tyh3 authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens CVE-2026-28498
GHSA-m344-f55w-2m6j
VCID-hrf7-xz6n-efcg Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11. CVE-2026-41425
GHSA-jj8c-mmj3-mmgv
PYSEC-2026-25
VCID-pt7d-e6h5-kbd2 authlib: Authlib: Information disclosure due to cryptographic padding oracle in JWE RSA1_5 CVE-2026-28490
GHSA-7432-952r-cw78
VCID-sk4t-73s6-rqg9 Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1. CVE-2026-44681
GHSA-r95x-qfjj-fjj2
PYSEC-2026-188
VCID-z4uj-gecb-1ucd Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification After upgrading the library from 1.5.2 to 1.6.0 (and the latest 1.6.5) it was noticed that previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected. CVE-2026-28802
GHSA-7wc2-qxgw-g8gg
VCID-zafh-nuvx-6fch authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability CVE-2026-27962
GHSA-wvwj-cvrp-7pv5

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T20:19:55.071745+00:00 Debian Importer Fixing VCID-4wgd-2mpe-tyh3 https://security-tracker.debian.org/tracker/data/json 38.6.0
2026-06-05T20:17:35.419441+00:00 Debian Importer Fixing VCID-pt7d-e6h5-kbd2 https://security-tracker.debian.org/tracker/data/json 38.6.0
2026-06-05T19:44:45.328046+00:00 Debian Importer Fixing VCID-sk4t-73s6-rqg9 https://security-tracker.debian.org/tracker/data/json 38.6.0
2026-06-05T19:20:54.373397+00:00 Debian Importer Fixing VCID-zafh-nuvx-6fch https://security-tracker.debian.org/tracker/data/json 38.6.0
2026-06-05T19:04:31.814870+00:00 Debian Importer Fixing VCID-hrf7-xz6n-efcg https://security-tracker.debian.org/tracker/data/json 38.6.0
2026-06-04T19:39:35.869781+00:00 Debian Importer Fixing VCID-z4uj-gecb-1ucd https://security-tracker.debian.org/tracker/data/json 38.6.0