authutils (5.0.3) potentially affected by CVE-2026-41425 via authlib (0.14.2)

authlib PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils 5.0.3 Source cves: CVE-2026-41425 Source advisory: OSV:GHSA-JJ8C-MMJ3-MMGV...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2026-41425 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2026-41425 Source advisory: OSV:GHSA-JJ8C-MMJ3-MMG...

cumulusci (>=3.32.0, <=3.37.0.dev0), lumapps-sdk (>=1.1.3b5, <=2.0.3) +3 more potentially affected by CVE-2026-41425 via authlib (0.15.3)

authlib PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - cumulusci =3.32.0, =1.1.3b5, =0.1.0, =0.53.1, =0.1.0, =0.1.9 Source cves: CVE-2026-41425 Source advisory: OSV:GHSA-JJ8C-MMJ3-MMGV...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-41425 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-41425...

authx (>=0.2.0, <=0.9.1), cumulusci (>=3.48.0, <=3.55.0.dev1) +4 more potentially affected by CVE-2026-41425 via authlib (0.15.5)

authlib PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authx =0.2.0, =3.48.0, =0.19.0, =1.0.1, =3.3.2 Source cves: CVE-2026-41425 Source advisory: OSV:GHSA-JJ8C-MMJ3-MMGV...

annotell-auth (>=1.2.0, <=1.6.1), apicrud (>=0.0.59, <=0.3.6) +36 more potentially affected by CVE-2026-41425 via authlib (0.15.6)

authlib PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - annotell-auth =1.2.0, =0.0.59, =0.5.0, =5.0.0b1, =0.1.0, =2.1.4, =0.1.1, =0.1.1, =0.1.0, =0.3.10, =0.1.0, =0.0.1, =0.7.2, =0.9.4 and more Source...

GHSA-JJ8C-MMJ3-MMGV Authlib: Cross-site request forging when using cache

Summary There is no CSRF protection on the cache feature on most integrations clients. Details In authlib.integrations.starletteclient.OAuth, no CSRF protection is set up when using the cache parameter. When not using the cache parameter, the use of SessionMiddleware ties the client to the auth...

Cross-site Request Forgery (CSRF)

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the Client integrations due to the lack of CSRF protection for cash parameters. An attacker can perform unauthorized actions on behalf...

PT-2026-35068

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.11 Description Authlib is a Python library used to build OAuth and OpenID Connect servers. A lack of Cross-Site Request Forgery CSRF protection exists in the cache feature of the 'authlib.integrations.starlette...

JOSE Authlib OAuth OpenID Connect Auth Bypass

The vulnerability of the JOSE library Authlib implementation for OAuth and OpenID Connect servers is related to improper verification of integrity values. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

JOSE Authlib Auth Bypass

The vulnerability of the JOSE library Authlib implementation for OAuth and OpenID Connect servers is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

JOSE Authlib OAuth OpenID Connect Signature Verification

The vulnerability of the JOSE library Authlib implementation for OAuth and OpenID Connect servers is related to errors in checking the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

openSUSE Security Advisory (SUSE-SU-2026:0975-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2026:0975-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Authlib (SUSE-SU-2026:0975-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0975-1 advisory. - CVE-2026-27962: JWS deserializecompact allows for signature bypass by accepting user-controlle...

Security update for python-Authlib

This update for python-Authlib fixes the following issues: CVE-2026-27962: JWS deserializecompact allows for signature bypass by accepting user-controlled embedded JWK as verification key bsc1259738. CVE-2026-28490: cryptographic padding oracle in JWE RSA15 key management algorithm bsc1259736...

JOSE Authlib OAuth OpenID Connect Auth Bypass

The vulnerability of the JOSE library Authlib implementation for OAuth and OpenID Connect servers is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Authentication Bypass

Authlib is vulnerable to Authentication Bypass. The vulnerability is due to fail-open behavior in the verifyhash function when processing unsupported or unknown algorithms, where hash validation incorrectly returns success, allowing attackers to forge ID Tokens and bypass integrity checks...

OPENSUSE-SU-2026:20392-1 Security update for python-Authlib

This update for python-Authlib fixes the following issues: Changes in python-Authlib: - CVE-2026-27962: JWS deserializecompact allows for signature bypass by accepting user-controlled embedded JWK as verification key bsc1259738 - CVE-2026-28490: cryptographic padding oracle in JWE RSA15 key...

SUSE CVE-2026-27962

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any...