authlib vulnerabilities

CVEs whose affected-version data names the authlib package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

10 CVEsRSS

CVE-2026-41479Medium· 5.4

3mo ago

Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

▾ Sunlitauthlib · authlibEPSS 0.18%via GHSA

CVE-2026-44681Medium· 6.1

4mo ago

Authlib is a Python library which builds OAuth and OpenID Connect servers

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. S…

▾ Midnightauthlib · authlibEPSS 0.23%via NVD

CVE-2026-27962Critical· 9.1PoC

6mo ago

Authlib is a Python library which builds OAuth and OpenID Connect servers

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that…

▾ Abyssalauthlib · authlibEPSS 0.55%via NVD

CVE-2026-28802Critical· 9.8⚖ disputed

6mo ago

Authlib is a Python library which builds OAuth and OpenID Connect servers

Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature…

▾ Midnightauthlib · authlibEPSS 0.43%via NVD

CVE-2025-68158Medium· 5.7

8mo ago