aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +301 more potentially affected by CVE-2026-114617 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-114617 Source advisory: SNYK:PYTHON-AUTHLIB-21460690...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +301 more potentially affected by CVE-2026-114619 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-114619 Source advisory: SNYK:PYTHON-AUTHLIB-21460691...

DEBIAN-CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...

CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...

DEBIAN-CVE-2026-114617

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid...

DEBIAN-CVE-2026-114616

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.importkey and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute...

DEBIAN-CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

DEBIAN-CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

DEBIAN-CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

CVE-2026-114617

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid...

CVE-2026-114616

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.importkey and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute...

CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

CVE-2026-114616

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.importkey and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute...

UBUNTU-CVE-2026-114616

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.importkey and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute...

UBUNTU-CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

CVE-2026-114617

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid...

CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...

CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...