Search for packages
| purl | pkg:pypi/authlib@1.6.9 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-hrf7-xz6n-efcg
Aliases: CVE-2026-41425 GHSA-jj8c-mmj3-mmgv PYSEC-2026-25 |
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11. |
Affected by 1 other vulnerability. |
|
VCID-sk4t-73s6-rqg9
Aliases: CVE-2026-44681 GHSA-r95x-qfjj-fjj2 PYSEC-2026-188 |
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4wgd-2mpe-tyh3 | authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens |
CVE-2026-28498
GHSA-m344-f55w-2m6j |
| VCID-pt7d-e6h5-kbd2 | authlib: Authlib: Information disclosure due to cryptographic padding oracle in JWE RSA1_5 |
CVE-2026-28490
GHSA-7432-952r-cw78 |
| VCID-zafh-nuvx-6fch | authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability |
CVE-2026-27962
GHSA-wvwj-cvrp-7pv5 |