917 matches found
GHSA-8M4G-J4WP-WGCG Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
Reporter: Cavan Loughran, Celvex Group Inc. Summary Authlib's symmetric oct key handling accepts an empty key empty bytes b'' / empty string '' as a valid HMAC signing and verification key. An empty HMAC key produces a deterministic digest that any party can reproduce, so an attacker who knows or...
EUVD-2026-108517
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery HS256/HS384/HS512...
GHSA-X4RV-C3WX-4CR8 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled requesturi authorization parameter straight to the getrequestobject fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this requesturis client metadata...
EUVD-2026-108522
Authlib: Unvalidated requesturi fetch in JWT-secured authorization request JAR leading to SSRF...
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled requesturi authorization parameter straight to the getrequestobject fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this requesturis client metadata...
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...
GHSA-C5MF-XMP2-59RC Authlib: ID token can disable its own nonce validation via the nonce_supported claim
Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...
EUVD-2026-108519
Authlib: ID token can disable its own nonce validation via the noncesupported claim...
GHSA-FCH4-3C6X-J4GC Authlib: Default JWT bearer grant accepts assertions for the wrong audience
Description Summary Authlib's default RFC 7523 JWT bearer grant leaves getaudiences empty, so verifyclaims only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any...
EUVD-2026-108520
Authlib: Default JWT bearer grant accepts assertions for the wrong audience...
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
Description Summary Authlib's default RFC 7523 JWT bearer grant leaves getaudiences empty, so verifyclaims only checks that an aud claim exists instead of requiring it to match the current authorization server's token endpoint. An attacker holding a legitimately issued JWT assertion for any...
GHSA-Q686-2QMG-HQC7 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...
EUVD-2026-108521
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens...
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
Summary OctKey.importkey carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is rawkey.startswithPOSSIBLEUNSAFEKEYS — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path...
GHSA-7VR2-2FGP-9W7P Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
Summary OctKey.importkey carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is rawkey.startswithPOSSIBLEUNSAFEKEYS — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path...
EUVD-2026-108514
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys...
GHSA-JJ7H-C3HG-M23X Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...
EUVD-2026-108513
Authlib: issecuretransport loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts...
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...