Search for packages
| purl | pkg:pypi/authlib@1.6.7 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-4wgd-2mpe-tyh3
Aliases: CVE-2026-28498 GHSA-m344-f55w-2m6j |
authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens |
Affected by 2 other vulnerabilities. |
|
VCID-hrf7-xz6n-efcg
Aliases: CVE-2026-41425 GHSA-jj8c-mmj3-mmgv PYSEC-2026-25 |
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11. |
Affected by 1 other vulnerability. |
|
VCID-pt7d-e6h5-kbd2
Aliases: CVE-2026-28490 GHSA-7432-952r-cw78 |
authlib: Authlib: Information disclosure due to cryptographic padding oracle in JWE RSA1_5 |
Affected by 2 other vulnerabilities. |
|
VCID-sk4t-73s6-rqg9
Aliases: CVE-2026-44681 GHSA-r95x-qfjj-fjj2 PYSEC-2026-188 |
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-zafh-nuvx-6fch
Aliases: CVE-2026-27962 GHSA-wvwj-cvrp-7pv5 |
authlib: Authlib: Authentication bypass due to JWK Header Injection vulnerability |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-z4uj-gecb-1ucd | Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification After upgrading the library from 1.5.2 to 1.6.0 (and the latest 1.6.5) it was noticed that previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected. |
CVE-2026-28802
GHSA-7wc2-qxgw-g8gg |