CVE-2025-59420High· 7.5▾ TwilightAuthlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
0.2% → 0.3%
Last analysed / modified upstream
Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation.
authlib: Authlib RFC violation — rated Important by Red Hat. Released 2025-09-22, updated 2026-09-21.
Fixed:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:23064 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:22182 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:23028
Workarounds / mitigations:
Affected packages:
authlib < 1.6.4Patched in:
authlib 1.6.4Connected by shared product, vendor, weakness, or advisory.
CVE-2025-47906Medium· 6.5os/exec: Unexpected paths returned from LookPath in os/exec (CVE-2025-47906)
CVE-2026-96889High· 7.8A flaw was found in librsvg
CVE-2026-97177Medium· 6.6A flaw was found in the user update mechanism of the Keycloak Admin REST API
CVE-2026-97176Medium· 4.2A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution
CVE-2026-75887High· 7.5A flaw was found in the OpenShift console
CVE-2026-75886High· 7.2A flaw was found in openshift/console