Authlib has 11 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The busiest recent month was March 2026 with 4. The median CVSS is 6.5 (medium), with 2 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-347 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 1 prev 3
Worst active — by depth score
CVE-2026-27962Critical· 9.1Authlib is a Python library which builds OAuth and OpenID Connect servers62CVE-2026-28802Critical· 9.8Authlib is a Python library which builds OAuth and OpenID Connect servers54CVE-2026-28498High· 7.5Authlib is a Python library which builds OAuth and OpenID Connect servers53CVE-2026-28490HighAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle41CVE-2025-61920High· 7.5Authlib is vulnerable to Denial of Service via Oversized JOSE Segments41
Authlib vulnerabilities
CVEs affecting Authlib, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-96760NoneAuthlib (v1.7.2 and below) contains a signature verification bypass vulnerability
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking f…
CVE-2026-41479Medium· 5.4Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
CVE-2026-44681Medium· 6.1Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect
Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect
CVE-2026-41425Medium· 5.4Authlib: Cross-site request forging when using cache
Authlib: Cross-site request forging when using cache
CVE-2026-28490HighAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
CVE-2026-28498High· 7.5PoCAuthlib is a Python library which builds OAuth and OpenID Connect servers
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. S…
CVE-2026-27962Critical· 9.1PoCAuthlib is a Python library which builds OAuth and OpenID Connect servers
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that…
CVE-2026-28802Critical· 9.8⚖ disputedAuthlib is a Python library which builds OAuth and OpenID Connect servers
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature…
CVE-2025-68158Medium· 5.7Authlib has 1-click Account Takeover vulnerability
Authlib has 1-click Account Takeover vulnerability
CVE-2025-61920High· 7.5Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
CVE-2025-62706Medium· 6.5Authlib : JWE zip=DEF decompression bomb enables DoS
Authlib : JWE zip=DEF decompression bomb enables DoS