CVE-2026-96760

CVE-2026-96760 - Authlib JWS Signature Verification Bypass PoC Proof-of-concept for a signature verification bypass in Authlib's authlib.jose module. JsonWebSignature.deserializejson accepts a General JSON JWS object with an empty signatures array and returns the attacker-controlled payload as...

ROOT-APP-PYPI-CVE-2026-114615 CVE-2026-114615 in Authlib - Patched by Root

Root has patched CVE-2026-114615 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-116672 CVE-2026-116672 in Authlib - Patched by Root

Root has patched CVE-2026-116672 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-114616 CVE-2026-114616 in Authlib - Patched by Root

Root has patched CVE-2026-114616 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-96760 CVE-2026-96760 in Authlib - Patched by Root

Root has patched CVE-2026-96760 in the Authlib package for Root:PyPI. Multiple fixed versions available...

CLEANSTART-2026-JE81317 Authlib is a Python library which builds OAuth and OpenID Connect servers

Security vulnerability affects the airflow-3 package. Authlib is a Python library which builds OAuth and OpenID Connect servers...

CLEANSTART-2026-LU42138 Authlib is a Python library which builds OAuth and OpenID Connect servers

Security vulnerability affects the airflow-3 package. Authlib is a Python library which builds OAuth and OpenID Connect servers...

CLEANSTART-2026-IK58625 Authlib is a Python library which builds OAuth and OpenID Connect servers

Security vulnerability affects the airflow-3 package. Authlib is a Python library which builds OAuth and OpenID Connect servers...

CLEANSTART-2026-IL52273 Authlib (v1

Security vulnerability affects the airflow-3 package. Authlib v1...

CLEANSTART-2026-YF35763 Authlib is a Python library which builds OAuth and OpenID Connect servers

Security vulnerability affects the airflow-3 package. Authlib is a Python library which builds OAuth and OpenID Connect servers...

CLEANSTART-2026-LO22956 Authlib is a Python library which builds OAuth and OpenID Connect servers

Security vulnerability affects the airflow-3 package. Authlib is a Python library which builds OAuth and OpenID Connect servers...

CLEANSTART-2026-GV69843 Authlib is a Python library which builds OAuth and OpenID Connect servers

Security vulnerability affects the airflow-3 package. Authlib is a Python library which builds OAuth and OpenID Connect servers...

CLEANSTART-2026-FN44303 Authlib is a Python library which builds OAuth and OpenID Connect servers

Security vulnerability affects the airflow-3 package. Authlib is a Python library which builds OAuth and OpenID Connect servers...

Authlib RFC 7592 Examples Omit Registration-access-token Client Binding

Description Summary RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol lets a previously registered client read, update, or delete its own registration, authenticated by a "registrationaccesstoken" issued specifically to that client at registration time. The entire security model ...

EUVD-2026-111112

Authlib RFC 7592 examples omit registration-access-token client binding...

Authlib RFC 7592 examples omit registration-access-token client binding

Description Summary RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol lets a previously registered client read, update, or delete its own registration, authenticated by a registrationaccesstoken issued specifically to that client at registration time. The entire security model of...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (>=1.0.0, <=1.0.3) +347 more potentially affected by CVE-2026-116672 via authlib (>=0.15.2, <=1.8.0)

authlib PYPI version =0.15.2, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =1.3.0a20250924 and more Source cves: CVE-2026-116672 Source advisory: GHSA-C73Q-W75P-J82V...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (>=1.0.0, <=1.0.3) +347 more potentially affected by CVE-2026-116672 via authlib (>=0.15.2, <=1.8.0)

authlib PYPI version =0.15.2, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =1.3.0a20250924 and more Source cves: CVE-2026-116672 Source advisory: OSV:GHSA-C73Q-W75P-J82V...

GHSA-C73Q-W75P-J82V Authlib RFC 7592 examples omit registration-access-token client binding

Description Summary RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol lets a previously registered client read, update, or delete its own registration, authenticated by a registrationaccesstoken issued specifically to that client at registration time. The entire security model of...

Authlib: Unvalidated Request_uri Fetch In JWT-secured Authorization Request (JAR) Leading To SSRF

Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled "requesturi" authorization parameter straight to the "getrequestobject" fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this "requesturis" client...