lumapps-sdk (>=1.0.0b13, <=1.0.0b18) potentially affected by CVE-2025-61920 via authlib (0.14.1)

authlib PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - lumapps-sdk =1.0.0b13, =1.0.0b18 Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

authutils (5.0.3) potentially affected by CVE-2025-62706 via authlib (0.14.2)

authlib PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils 5.0.3 Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...

authutils (5.0.3) potentially affected by CVE-2025-61920 via authlib (0.14.2)

authlib PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils 5.0.3 Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2025-62706 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2025-62706 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2025-61920 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

cumulusci (>=3.32.0, <=3.37.0.dev0), lumapps-sdk (>=1.1.3b5, <=2.0.3) +3 more potentially affected by CVE-2025-62706 via authlib (0.15.3)

authlib PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - cumulusci =3.32.0, =1.1.3b5, =0.1.0, =0.53.1, =0.1.0, =0.1.9 Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...

cumulusci (>=3.32.0, <=3.37.0.dev0), lumapps-sdk (>=1.1.3b5, <=2.0.3) +3 more potentially affected by CVE-2025-61920 via authlib (0.15.3)

authlib PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - cumulusci =3.32.0, =1.1.3b5, =0.1.0, =0.53.1, =0.1.0, =0.1.9 Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2025-62706 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2025-62706...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2025-61920 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2025-61920...

authx (>=0.2.0, <=0.9.1), cumulusci (>=3.48.0, <=3.55.0.dev1) +4 more potentially affected by CVE-2025-62706 via authlib (0.15.5)

authlib PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authx =0.2.0, =3.48.0, =0.19.0, =1.0.1, =3.3.2 Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...

authx (>=0.2.0, <=0.9.1), cumulusci (>=3.48.0, <=3.55.0.dev1) +4 more potentially affected by CVE-2025-61920 via authlib (0.15.5)

authlib PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authx =0.2.0, =3.48.0, =0.19.0, =1.0.1, =3.3.2 Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

annotell-auth (>=1.2.0, <=1.6.1), apicrud (>=0.0.59, <=0.3.6) +36 more potentially affected by CVE-2025-62706 via authlib (0.15.6)

authlib PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - annotell-auth =1.2.0, =0.0.59, =0.5.0, =5.0.0b1, =0.1.0, =2.1.4, =0.1.1, =0.1.1, =0.1.0, =0.3.10, =0.1.0, =0.0.1, =0.7.2, =0.9.4 and more Source...

annotell-auth (>=1.2.0, <=1.6.1), apicrud (>=0.0.59, <=0.3.6) +36 more potentially affected by CVE-2025-61920 via authlib (0.15.6)

authlib PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - annotell-auth =1.2.0, =0.0.59, =0.5.0, =5.0.0b1, =0.1.0, =2.1.4, =0.1.1, =0.1.1, =0.1.0, =0.3.10, =0.1.0, =0.0.1, =0.7.2, =0.9.4 and more Source...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.4.3) +159 more potentially affected by CVE-2025-61920 via authlib (>=1.0.0b2, <=1.6.4)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =0.16.0, =0.33.0, =0.43.0 and more Source cves: CVE-2025-61920 Source advisory: OSV:PYSEC-2026-1203...

PYSEC-2026-1203 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

Summary Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving...

PYSEC-2026-1202 Authlib : JWE zip=DEF decompression bomb enables DoS

Summary Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. Details - Affected component...

authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2025-61920 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.4.3) +159 more potentially affected by CVE-2025-62706 via authlib (>=1.0.0b2, <=1.6.4)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =0.16.0, =0.33.0, =0.43.0 and more Source cves: CVE-2025-62706 Source advisory: OSV:PYSEC-2026-1202...

meltano (>=1.60.0, <=2.1.0), molten-jwt (0.2.1) potentially affected by CVE-2025-59420 via authlib (0.10.0)

authlib PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - meltano =1.60.0, =2.1.0 - molten-jwt 0.2.1 Source cves: CVE-2025-59420 Source advisory: OSV:PYSEC-2026-1200...