Linux Distros Unpatched Vulnerability : CVE-2026-104056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a...

CVE-2026-104056

A flaw was found in Authlib. The OpenID Connect OIDC and OAuth discovery metadata is cached without validating that returned endpoint addresses match the origin of the configured issuer. A remote attacker who supplies a malicious discovery response can replace legitimate service endpoints with...

DEBIAN-CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

UBUNTU-CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

EUVD-2026-91003

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056 CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056 CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

The Authlib library (version 1.7.2 and below) contains a vulnerability where OpenID Connect (OIDC) and OAuth discovery metadata is cached without sufficient validation or issuer-origin binding . A remote attacker providing a malicious discovery response can replace legitimate service endpoints wi...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

PT-2026-103966

🚨Critical - Authlib OpenID Discovery Cache Poisoning CVE-2026-104056 Authlib caches OIDC discovery JSON .well-known/openid-configuration without validating issuer/origin binding. By poisoning the cached discovery response, an attacker can swap authorization/token/jwks uri endpoints to...

CVE-2026-104056: Insufficient Verification of Data Authenticity

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

Linux Distros Unpatched Vulnerability : CVE-2026-96760

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS...

SUSE CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

1c-formsserver (0.20260729.0), 3designs (>=1.0.0, <=1.0.1) +9711 more potentially affected by CVE-2026-96760 via authlib (>=0.10.0, <=1.8.0)

authlib PYPI version =0.10.0, =1.0.0, =0.0.12, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.0.6, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.2 and more Source cves: CVE-2026-96760 Source advisory: SNYK:PYTHON-AUTHLIB-20257410...

Improper Verification of Cryptographic Signature

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JsonWebSignature.deserializejson method in the JWS JSON serialization handling. An attacker can have unsigned or...

CVE-2026-96760

A flaw was found in authlib. This flaw allows a remote attacker to bypass digital signature verification and submit forged data. When processing a JSON Web Signature JWS, a format used to verify data integrity, the deserializejson function marks payloads as successfully verified without validatin...

CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

DEBIAN-CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...