EUVD-2026-88465

Authlib: empty signatures validation in JWS JSON deserialization...

GHSA-6V38-4H7W-RJ9H Authlib: empty signatures validation in JWS JSON deserialization

Authlib prior to 1.9.0 contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. Root caus...

Authlib: empty signatures validation in JWS JSON deserialization

Authlib prior to 1.9.0 contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. Root caus...

CVE-2026-116672: Authorization Bypass Through User-Controlled Key

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...

PT-2026-126683

Name of the Vulnerable Software and Affected Versions Authlib versions 0.15 through 1.9.0 Description Reference implementations of ClientConfigurationEndpoint.authenticate client and ClientConfigurationEndpoint.check permission look up a target client using client id data from the request and...

UBUNTU-CVE-2026-114617

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid...

UBUNTU-CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

UBUNTU-CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...

UBUNTU-CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

Security Bulletin: IBM Db2 Bridge is vulnerable due to Authlib, urllib3, jackson-databind, source-map-js, Axios, and python-jose

Summary Authlib, urllib3, jackson-databind, source-map-js, Axios, and python-jose is used as part of IBM Db2 Bridge and it was affected by vulnerabilities described in the vulnerability details. This issue Affected users using Db2 Bridge 1.1.5.2 and new Fix pack was release to address the issue...

SUSE CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

SUSE CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

SUSE CVE-2026-114616

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.importkey and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute...

SUSE CVE-2026-114617

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid...

CVE-2026-114616

A flaw was found in Authlib. The library improperly accepts zero-length key material during Hash-based Message Authentication Code HMAC signing and verification. If a host application verifies tokens using a secret that evaluates to an empty value, a remote attacker can generate predictable...

CVE-2026-114615

A flaw was found in Authlib. When verifying JSON Web Tokens JWT, the library fails to properly recognize asymmetric public keys that contain leading whitespace, comments, or formatting prefixes. An unauthenticated remote attacker who knows the public key can exploit this flaw to forge symmetric...

Server-side Request Forgery (SSRF)

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the parseidtoken function in syncopenid.py and asyncopenid.py, where an ID Token containing a noncesupported: false claim causes non...

agentstack-cli (>=0.4.0rc1, <=0.7.1), agience-origin (>=0.1.0, <=0.2.9) +187 more potentially affected by CVE-2026-114620 via authlib (>=1.6.0, <=1.8.0)

authlib PYPI version =1.6.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.5.0, =0.9.5, =0.19.0, =0.38.0, =0.1.0, =0.1.0, =0.1.0, =1.7.0, =0.1.0, =1.0.2, =3.29.0 and more Source cves: CVE-2026-114620 Source advisory: SNYK:PYTHON-AUTHLIB-21460696...

CVE-2026-114614

A flaw was found in Authlib. The library's transport security verification improperly validates web addresses by using prefix matching to exempt local loopback addresses from encryption requirements. A remote attacker can exploit this issue by supplying a crafted URL containing local host...

CVE-2026-114620

A flaw was found in Authlib. A remote attacker can trigger Server-Side Request Forgery SSRF by submitting an unvalidated request URI parameter in an authorization request. Because the library forwards client-supplied addresses to internal retrieval handlers without enforcing destination policies ...