authx (>=0.2.0, <=0.9.1), cumulusci (>=3.48.0, <=3.55.0.dev1) +4 more potentially affected by CVE-2026-28490 via authlib (0.15.5)

authlib PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authx =0.2.0, =3.48.0, =0.19.0, =1.0.1, =3.3.2 Source cves: CVE-2026-28490 Source advisory: OSV:GHSA-7432-952R-CW78...

EUVD-2026-12478

Authlib JWS JWK Header Injection: Signature Verification Bypass...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.6.2) +174 more potentially affected by CVE-2026-27962 via authlib (>=1.0.0b2, <=1.6.8)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =0.16.0, =0.22.0 and more Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2026-27962 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV...

GHSA-WVWJ-CVRP-7PV5 Authlib JWS JWK Header Injection: Signature Verification Bypass

Description Summary A JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic...

meltano (>=1.60.0, <=2.1.0), molten-jwt (0.2.1) potentially affected by CVE-2026-27962 via authlib (0.10.0)

authlib PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - meltano =1.60.0, =2.1.0 - molten-jwt 0.2.1 Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

authutils (>=6.1.2, <=6.2.2), dash-google-oauth (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2026-27962 via authlib (0.11.0)

authlib PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils =6.1.2, =1.0.0, =0.1.2, =0.2.0.dev5 Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

lumapps-sdk (>=1.0.0b13, <=1.0.0b18) potentially affected by CVE-2026-27962 via authlib (0.14.1)

authlib PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - lumapps-sdk =1.0.0b13, =1.0.0b18 Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

authutils (5.0.3) potentially affected by CVE-2026-27962 via authlib (0.14.2)

authlib PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils 5.0.3 Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2026-27962 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

cumulusci (>=3.32.0, <=3.37.0.dev0), lumapps-sdk (>=1.1.3b5, <=2.0.3) +3 more potentially affected by CVE-2026-27962 via authlib (0.15.3)

authlib PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - cumulusci =3.32.0, =1.1.3b5, =0.1.0, =0.53.1, =0.1.0, =0.1.9 Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-27962 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-27962...

annotell-auth (>=1.2.0, <=1.6.1), apicrud (>=0.0.59, <=0.3.6) +36 more potentially affected by CVE-2026-27962 via authlib (0.15.6)

authlib PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - annotell-auth =1.2.0, =0.0.59, =0.5.0, =5.0.0b1, =0.1.0, =2.1.4, =0.1.1, =0.1.1, =0.1.0, =0.3.10, =0.1.0, =0.0.1, =0.7.2, =0.9.4 and more Source...

molten-jwt (0.3.0) potentially affected by CVE-2026-27962 via authlib (0.12.1)

authlib PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - molten-jwt 0.3.0 Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

authx (>=0.2.0, <=0.9.1), cumulusci (>=3.48.0, <=3.55.0.dev1) +4 more potentially affected by CVE-2026-27962 via authlib (0.15.5)

authlib PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authx =0.2.0, =3.48.0, =0.19.0, =1.0.1, =3.3.2 Source cves: CVE-2026-27962 Source advisory: OSV:GHSA-WVWJ-CVRP-7PV5...

Authlib JWS JWK Header Injection: Signature Verification Bypass

Description Summary A JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.6.2) +174 more potentially affected by CVE-2026-27962 via authlib (>=1.0.0b2, <=1.6.8)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =0.16.0, =0.22.0 and more Source cves: CVE-2026-27962 Source advisory: GHSA-WVWJ-CVRP-7PV5...

Authlib encryption vulnerability

Authlib is an open-source library developed by Authlib, designed as a ultimate Python library for building OAuth and OpenID Connect servers. Versions of Authlib prior to 1.6.9 contained a security vulnerability related to encryption. This vulnerability stemmed from a cryptographic padding mechani...

Authlib data forgery vulnerability

Authlib is an open-source library developed by Authlib, designed to build servers for OAuth and OpenID Connect. Versions of Authlib prior to 1.6.9 contained a data manipulation vulnerability, caused by header injection in the JWS implementation. This vulnerability could allow unauthenticated...

CVE-2026-28498: Improper Validation of Integrity Check Value

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect OIDC ID Tokens. Specifically, the internal hash verification logic verifyhash...