ROOT-APP-PYPI-GHSA-JJ8C-MMJ3-MMGV GHSA-jj8c-mmj3-mmgv in Authlib - Patched by Root

Root has patched GHSA-jj8c-mmj3-mmgv in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-28802 CVE-2026-28802 in Authlib - Patched by Root

Root has patched CVE-2026-28802 in the Authlib package for Root:PyPI. Multiple fixed versions available...

[SECURITY] [DLA 4708-1] python-authlib security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4708-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura July 31, 2026 https://wiki.debian.org/LTS -...

Debian dla-4708 : python-authlib-doc - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4708 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4708-1 [email protected]...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Authlib vulnerabilities (USN-8557-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8557-1 advisory. Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded in JWT headers. An...

USN-8557-1: Authlib vulnerabilities

Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded in JWT headers. An attacker could possibly use this issue to forge trusted tokens, resulting in authentication and authorization bypass. CVE-2026-27962 Jay Neiva and Mauro Carrillo discovere...

SUSE SLED15 / SLES15 Security Update : python-Authlib (SUSE-SU-2026:2968-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2968-1 advisory. This update for python-Authlib fixes the following issues - CVE-2026-41425: Prior to 1.6.11, there is no CSRF...

Security update for python-Authlib

This update for python-Authlib fixes the following issues CVE-2026-41425: no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth bsc1263114. CVE-2026-44681: unauthenticated open redirect in the OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoints...

Authlib has 1-click Account Takeover vulnerability

Security Advisory: Cache-Backed State Storage CSRF in AuthlibThe Security Labs team at Snyk has reported a security issue affecting Authlib, identified during a recent research project.The Snyk Security Labs team has identified a vulnerability that can result in a one-click account takeover in...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.4.3) +159 more potentially affected by CVE-2025-68158 via authlib (>=1.0.0, <=1.6.5)

authlib PYPI version =1.0.0, =1.0.0, =0.4.0rc1, =0.1.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =0.16.0, =0.33.0, =0.45.0 and more Source cves: CVE-2025-68158 Source advisory: OSV:PYSEC-2026-1201...

PYSEC-2026-1201 Authlib has 1-click Account Takeover vulnerability

Security Advisory: Cache-Backed State Storage CSRF in Authlib The Security Labs team at Snyk has reported a security issue affecting Authlib, identified during a recent research project. The Snyk Security Labs team has identified a vulnerability that can result in a one-click account takeover in...

Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

SummaryAuthlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving...

Authlib : JWE zip=DEF decompression bomb enables DoS

SummaryAuthlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. Details- Affected component:...

meltano (>=1.60.0, <=2.1.0), molten-jwt (0.2.1) potentially affected by CVE-2025-62706 via authlib (0.10.0)

authlib PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - meltano =1.60.0, =2.1.0 - molten-jwt 0.2.1 Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...

meltano (>=1.60.0, <=2.1.0), molten-jwt (0.2.1) potentially affected by CVE-2025-61920 via authlib (0.10.0)

authlib PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - meltano =1.60.0, =2.1.0 - molten-jwt 0.2.1 Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

authutils (>=6.1.2, <=6.2.2), dash-google-oauth (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2025-62706 via authlib (0.11.0)

authlib PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils =6.1.2, =1.0.0, =0.1.2, =0.2.0.dev5 Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...

authutils (>=6.1.2, <=6.2.2), dash-google-oauth (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2025-61920 via authlib (0.11.0)

authlib PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils =6.1.2, =1.0.0, =0.1.2, =0.2.0.dev5 Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

molten-jwt (0.3.0) potentially affected by CVE-2025-62706 via authlib (0.12.1)

authlib PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - molten-jwt 0.3.0 Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...

molten-jwt (0.3.0) potentially affected by CVE-2025-61920 via authlib (0.12.1)

authlib PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - molten-jwt 0.3.0 Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

lumapps-sdk (>=1.0.0b13, <=1.0.0b18) potentially affected by CVE-2025-62706 via authlib (0.14.1)

authlib PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - lumapps-sdk =1.0.0b13, =1.0.0b18 Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...