[ Vendor · 10 CVEs ]
authlib
CVEs affecting authlib published in the last 30 days, plus any authlib CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114620 | 22 Oct 2026 | CVSS 5.4 | authlibAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the… | |
| CVE-2026-114615 | 22 Oct 2026 | CVSS 7.4 | authlibAuthlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers… | |
| CVE-2026-114616 | 22 Oct 2026 | CVSS 7.4 | authlibAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and… | |
| CVE-2026-114617 | 22 Oct 2026 | CVSS 4.2 | authlibAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported… | |
| CVE-2026-114618 | 22 Oct 2026 | CVSS 6.8 | authlibAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences()… | |
| CVE-2026-114619 | 22 Oct 2026 | CVSS 4.6 | authlibAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request()… | |
| CVE-2026-114614 | 22 Oct 2026 | CVSS 2.6 | authlibAuthlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses… | |
| CVE-2026-102946 | 15 Oct 2026 | CVSS 9.1 | authlib joserfcjoserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4… | |
| CVE-2026-104056 | 1 Oct 2026 | CVSS 9.8 | AuthlibAuthlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This… | |
| CVE-2026-96760 | 28 Sep 2026 | CVSS 9.8 | AuthlibAuthlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON… |