Vulnerability-Lookup

OPENSUSE-SU-2026:12390-1

Vulnerability from csaf_opensuse - Published: 2026-11-02 00:00 - Updated: 2026-11-03 21:53

Summary

python313-Authlib-1.9.1-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: python313-Authlib-1.9.1-1.1 on GA media

Description of the patch: These are all security issues fixed in the python313-Authlib-1.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-12390

CVE-2025-62706

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-114614

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact low

CVE-2026-114615

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact important

CVE-2026-114616

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact important

CVE-2026-114617

4.2 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact moderate

CVE-2026-114618

6.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact moderate

CVE-2026-114619

4.6 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact moderate

CVE-2026-116672

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact important

CVE-2026-41425

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact moderate

CVE-2026-96760

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 8 products, the same list as for CVE-2025-62706

Threats

Impact important

References

32 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2025-62706/	self
https://www.suse.com/security/cve/CVE-2026-114614/	self
https://www.suse.com/security/cve/CVE-2026-114615/	self
https://www.suse.com/security/cve/CVE-2026-114616/	self
https://www.suse.com/security/cve/CVE-2026-114617/	self
https://www.suse.com/security/cve/CVE-2026-114618/	self
https://www.suse.com/security/cve/CVE-2026-114619/	self
https://www.suse.com/security/cve/CVE-2026-116672/	self
https://www.suse.com/security/cve/CVE-2026-41425/	self
https://www.suse.com/security/cve/CVE-2026-96760/	self
https://www.suse.com/security/cve/CVE-2025-62706	external
https://bugzilla.suse.com/1252504	external
https://www.suse.com/security/cve/CVE-2026-114614	external
https://bugzilla.suse.com/1287192	external
https://www.suse.com/security/cve/CVE-2026-114615	external
https://bugzilla.suse.com/1287193	external
https://www.suse.com/security/cve/CVE-2026-114616	external
https://bugzilla.suse.com/1287195	external
https://www.suse.com/security/cve/CVE-2026-114617	external
https://bugzilla.suse.com/1287362	external
https://www.suse.com/security/cve/CVE-2026-114618	external
https://bugzilla.suse.com/1287999	external
https://www.suse.com/security/cve/CVE-2026-114619	external
https://bugzilla.suse.com/1287998	external
https://www.suse.com/security/cve/CVE-2026-116672	external
https://bugzilla.suse.com/1288515	external
https://www.suse.com/security/cve/CVE-2026-41425	external
https://bugzilla.suse.com/1263114	external
https://www.suse.com/security/cve/CVE-2026-96760	external
https://bugzilla.suse.com/1283079	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python313-Authlib-1.9.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python313-Authlib-1.9.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12390",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12390-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-62706 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-62706/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-114614 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-114614/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-114615 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-114615/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-114616 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-114616/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-114617 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-114617/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-114618 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-114618/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-114619 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-114619/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-116672 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-116672/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-41425 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-41425/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-96760 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-96760/"
      }
    ],
    "title": "python313-Authlib-1.9.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-11-03T21:53:43Z",
      "generator": {
        "date": "2026-11-02T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12390-1",
      "initial_release_date": "2026-11-02T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-11-02T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-11-03T21:53:43Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Authlib-0:1.9.1-1.1.aarch64",
                "product": {
                  "name": "python313-Authlib-0:1.9.1-1.1.aarch64",
                  "product_id": "python313-Authlib-0:1.9.1-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Authlib@1.9.1-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Authlib-0:1.9.1-1.1.aarch64",
                "product": {
                  "name": "python314-Authlib-0:1.9.1-1.1.aarch64",
                  "product_id": "python314-Authlib-0:1.9.1-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Authlib@1.9.1-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Authlib-0:1.9.1-1.1.ppc64le",
                "product": {
                  "name": "python313-Authlib-0:1.9.1-1.1.ppc64le",
                  "product_id": "python313-Authlib-0:1.9.1-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Authlib@1.9.1-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Authlib-0:1.9.1-1.1.ppc64le",
                "product": {
                  "name": "python314-Authlib-0:1.9.1-1.1.ppc64le",
                  "product_id": "python314-Authlib-0:1.9.1-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Authlib@1.9.1-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Authlib-0:1.9.1-1.1.s390x",
                "product": {
                  "name": "python313-Authlib-0:1.9.1-1.1.s390x",
                  "product_id": "python313-Authlib-0:1.9.1-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Authlib@1.9.1-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Authlib-0:1.9.1-1.1.s390x",
                "product": {
                  "name": "python314-Authlib-0:1.9.1-1.1.s390x",
                  "product_id": "python314-Authlib-0:1.9.1-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Authlib@1.9.1-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python313-Authlib-0:1.9.1-1.1.x86_64",
                "product": {
                  "name": "python313-Authlib-0:1.9.1-1.1.x86_64",
                  "product_id": "python313-Authlib-0:1.9.1-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-Authlib@1.9.1-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-Authlib-0:1.9.1-1.1.x86_64",
                "product": {
                  "name": "python314-Authlib-0:1.9.1-1.1.x86_64",
                  "product_id": "python314-Authlib-0:1.9.1-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-Authlib@1.9.1-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Authlib-0:1.9.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64"
        },
        "product_reference": "python313-Authlib-0:1.9.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Authlib-0:1.9.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le"
        },
        "product_reference": "python313-Authlib-0:1.9.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Authlib-0:1.9.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x"
        },
        "product_reference": "python313-Authlib-0:1.9.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Authlib-0:1.9.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64"
        },
        "product_reference": "python313-Authlib-0:1.9.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Authlib-0:1.9.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64"
        },
        "product_reference": "python314-Authlib-0:1.9.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Authlib-0:1.9.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le"
        },
        "product_reference": "python314-Authlib-0:1.9.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Authlib-0:1.9.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x"
        },
        "product_reference": "python314-Authlib-0:1.9.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-Authlib-0:1.9.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        },
        "product_reference": "python314-Authlib-0:1.9.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-62706",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-62706"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib\u0027s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-62706",
          "url": "https://www.suse.com/security/cve/CVE-2025-62706"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1252504 for CVE-2025-62706",
          "url": "https://bugzilla.suse.com/1252504"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-62706"
    },
    {
      "cve": "CVE-2026-114614",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-114614"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-114614",
          "url": "https://www.suse.com/security/cve/CVE-2026-114614"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287192 for CVE-2026-114614",
          "url": "https://bugzilla.suse.com/1287192"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-114614"
    },
    {
      "cve": "CVE-2026-114615",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-114615"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib\u0027s PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-114615",
          "url": "https://www.suse.com/security/cve/CVE-2026-114615"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287193 for CVE-2026-114615",
          "url": "https://bugzilla.suse.com/1287193"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-114615"
    },
    {
      "cve": "CVE-2026-114616",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-114616"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib\u0027s OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application\u0027s secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-114616",
          "url": "https://www.suse.com/security/cve/CVE-2026-114616"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287195 for CVE-2026-114616",
          "url": "https://bugzilla.suse.com/1287195"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-114616"
    },
    {
      "cve": "CVE-2026-114617",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-114617"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim\u0027s token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-114617",
          "url": "https://www.suse.com/security/cve/CVE-2026-114617"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287362 for CVE-2026-114617",
          "url": "https://bugzilla.suse.com/1287362"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-114617"
    },
    {
      "cve": "CVE-2026-114618",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-114618"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server\u0027s valid audience identifiers are not affected. This issue is fixed in version 1.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-114618",
          "url": "https://www.suse.com/security/cve/CVE-2026-114618"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287999 for CVE-2026-114618",
          "url": "https://bugzilla.suse.com/1287999"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-114618"
    },
    {
      "cve": "CVE-2026-114619",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-114619"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user\u0027s subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-114619",
          "url": "https://www.suse.com/security/cve/CVE-2026-114619"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1287998 for CVE-2026-114619",
          "url": "https://bugzilla.suse.com/1287998"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-114619"
    },
    {
      "cve": "CVE-2026-116672",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-116672"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client\u0027s registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-116672",
          "url": "https://www.suse.com/security/cve/CVE-2026-116672"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1288515 for CVE-2026-116672",
          "url": "https://bugzilla.suse.com/1288515"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-116672"
    },
    {
      "cve": "CVE-2026-41425",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-41425"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth.  This vulnerability is fixed in 1.6.11.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-41425",
          "url": "https://www.suse.com/security/cve/CVE-2026-41425"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263114 for CVE-2026-41425",
          "url": "https://bugzilla.suse.com/1263114"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-41425"
    },
    {
      "cve": "CVE-2026-96760",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-96760"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-96760",
          "url": "https://www.suse.com/security/cve/CVE-2026-96760"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283079 for CVE-2026-96760",
          "url": "https://bugzilla.suse.com/1283079"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-Authlib-0:1.9.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-Authlib-0:1.9.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-96760"
    }
  ]
}

CVE-2025-62706 (GCVE-0-2025-62706)

Vulnerability from cvelistv5 – Published: 2025-10-22 21:31 – Updated: 2025-11-03 17:45

Title

Authlib : JWE zip=DEF decompression bomb enables DoS

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-23 15:44 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/commit/e0863d5…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: < 1.6.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62706",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-23T15:44:18.329916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-23T15:44:43.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:45:27.594Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib\u2019s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-22T21:31:10.997Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d"
        }
      ],
      "source": {
        "advisory": "GHSA-g7f3-828f-7h7m",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib : JWE zip=DEF decompression bomb enables DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-62706",
    "datePublished": "2025-10-22T21:31:10.997Z",
    "dateReserved": "2025-10-20T19:41:22.738Z",
    "dateUpdated": "2025-11-03T17:45:27.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114614 (GCVE-0-2026-114614)

Vulnerability from cvelistv5 – Published: 2026-10-22 21:00 – Updated: 2026-10-29 13:49

Title

Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.

Severity

2.6 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 13:49 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/commit/95ad1f9…	x_refsource_MISC
https://github.com/authlib/authlib/releases/tag/v1.8.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: < 1.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114614",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T13:49:16.938418Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T13:49:50.607Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/authlib/authlib/security/advisories/GHSA-jj7h-c3hg-m23x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T21:00:14.354Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-jj7h-c3hg-m23x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-jj7h-c3hg-m23x"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/95ad1f90acf0c7b9cf2a8f25e6eb3f1135b8dc70",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/95ad1f90acf0c7b9cf2a8f25e6eb3f1135b8dc70"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.8.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.8.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jj7h-c3hg-m23x",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114614",
    "datePublished": "2026-10-22T21:00:14.354Z",
    "dateReserved": "2026-10-21T20:34:25.599Z",
    "dateUpdated": "2026-10-29T13:49:50.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114615 (GCVE-0-2026-114615)

Vulnerability from cvelistv5 – Published: 2026-10-22 21:10 – Updated: 2026-10-29 02:38

Title

Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 02:37 UTC

CWE

CWE-184 - Incomplete List of Disallowed Inputs
CWE-347 - Improper Verification of Cryptographic Signature

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/pull/945	x_refsource_MISC
https://github.com/authlib/authlib/commit/e3bd41c…	x_refsource_MISC
https://github.com/authlib/authlib/releases/tag/v1.9.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: >= 1.3.1, < 1.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114615",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T02:37:41.689098Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T02:38:05.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/authlib/authlib/security/advisories/GHSA-7vr2-2fgp-9w7p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.3.1, \u003c 1.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib\u0027s PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347: Improper Verification of Cryptographic Signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T21:10:02.023Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-7vr2-2fgp-9w7p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-7vr2-2fgp-9w7p"
        },
        {
          "name": "https://github.com/authlib/authlib/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/pull/945"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-7vr2-2fgp-9w7p",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114615",
    "datePublished": "2026-10-22T21:10:02.023Z",
    "dateReserved": "2026-10-21T20:34:25.600Z",
    "dateUpdated": "2026-10-29T02:38:05.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114616 (GCVE-0-2026-114616)

Vulnerability from cvelistv5 – Published: 2026-10-22 21:14 – Updated: 2026-10-30 20:07

Title

Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 20:07 UTC

CWE

CWE-287 - Improper Authentication
CWE-326 - Inadequate Encryption Strength
CWE-1391 - Use of Weak Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/commit/4ff30db…	x_refsource_MISC
https://github.com/authlib/authlib/releases/tag/v1.9.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: < 1.9.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114616",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T20:07:25.381279Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T20:07:37.170Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib\u0027s OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application\u0027s secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-326",
              "description": "CWE-326: Inadequate Encryption Strength",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1391",
              "description": "CWE-1391: Use of Weak Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T21:14:03.060Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.9.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.9.1"
        }
      ],
      "source": {
        "advisory": "GHSA-8m4g-j4wp-wgcg",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114616",
    "datePublished": "2026-10-22T21:14:03.060Z",
    "dateReserved": "2026-10-21T20:34:25.600Z",
    "dateUpdated": "2026-10-30T20:07:37.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114617 (GCVE-0-2026-114617)

Vulnerability from cvelistv5 – Published: 2026-10-22 21:25 – Updated: 2026-10-23 15:00

Title

Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-23 14:48 UTC

CWE

CWE-294 - Authentication Bypass by Capture-replay
CWE-807 - Reliance on Untrusted Inputs in a Security Decision

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/pull/949	x_refsource_MISC
https://github.com/authlib/authlib/commit/6563f6f…	x_refsource_MISC
https://github.com/authlib/authlib/releases/tag/v1.9.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: < 1.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114617",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:48:38.535654Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T15:00:16.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim\u0027s token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294: Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T21:25:31.732Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc"
        },
        {
          "name": "https://github.com/authlib/authlib/pull/949",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/pull/949"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-c5mf-xmp2-59rc",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib: ID token can disable its own nonce validation via the nonce_supported claim"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114617",
    "datePublished": "2026-10-22T21:25:31.732Z",
    "dateReserved": "2026-10-21T20:34:25.600Z",
    "dateUpdated": "2026-10-23T15:00:16.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114618 (GCVE-0-2026-114618)

Vulnerability from cvelistv5 – Published: 2026-10-22 21:28 – Updated: 2026-10-29 12:29

Title

Authlib: Default JWT bearer grant accepts assertions for the wrong audience

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server's valid audience identifiers are not affected. This issue is fixed in version 1.9.0.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 12:28 UTC

CWE

CWE-287 - Improper Authentication
CWE-1188 - Insecure Default Initialization of Resource

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/pull/945	x_refsource_MISC
https://github.com/authlib/authlib/commit/e3bd41c…	x_refsource_MISC
https://github.com/authlib/authlib/releases/tag/v1.9.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: < 1.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114618",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T12:28:44.727870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T12:29:17.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.get_audiences() returns an empty list, causing JWTBearerGrant.verify_claims() to require only that an aud claim exists without matching the current authorization server. An attacker holding a legitimate assertion for another service can present it to a server that shares the signing key and uses the default grant, obtaining an access token across a trust boundary. Implementations that override get_audiences() with the server\u0027s valid audience identifiers are not affected. This issue is fixed in version 1.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T21:28:37.879Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fch4-3c6x-j4gc"
        },
        {
          "name": "https://github.com/authlib/authlib/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/pull/945"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-fch4-3c6x-j4gc",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib: Default JWT bearer grant accepts assertions for the wrong audience"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114618",
    "datePublished": "2026-10-22T21:28:37.879Z",
    "dateReserved": "2026-10-21T20:34:25.600Z",
    "dateUpdated": "2026-10-29T12:29:17.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114619 (GCVE-0-2026-114619)

Vulnerability from cvelistv5 – Published: 2026-10-22 21:31 – Updated: 2026-10-29 02:40

Title

Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user's subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0.

Severity

4.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 02:40 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/pull/945	x_refsource_MISC
https://github.com/authlib/authlib/commit/e3bd41c…	x_refsource_MISC
https://github.com/authlib/authlib/releases/tag/v1.9.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: < 1.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114619",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T02:40:03.830878Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T02:40:27.668Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/authlib/authlib/security/advisories/GHSA-q686-2qmg-hqc7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user\u0027s subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T21:31:02.929Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-q686-2qmg-hqc7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-q686-2qmg-hqc7"
        },
        {
          "name": "https://github.com/authlib/authlib/pull/945",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/pull/945"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-q686-2qmg-hqc7",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114619",
    "datePublished": "2026-10-22T21:31:02.929Z",
    "dateReserved": "2026-10-21T20:34:25.600Z",
    "dateUpdated": "2026-10-29T02:40:27.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116672 (GCVE-0-2026-116672)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:31 – Updated: 2026-10-30 20:15

Title

Authlib RFC 7592 examples omit registration-access-token client binding

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-30 20:15 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-1188 - Insecure Default Initialization of Resource

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
https://github.com/authlib/authlib/commit/1bd2a31…	x_refsource_MISC
https://github.com/authlib/authlib/releases/tag/v1.9.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: >= 0.15, < 1.9.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116672",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T20:15:27.934489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T20:15:42.022Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.15, \u003c 1.9.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client\u0027s registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Insecure Default Initialization of Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:31:48.429Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.9.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.9.1"
        }
      ],
      "source": {
        "advisory": "GHSA-c73q-w75p-j82v",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib RFC 7592 examples omit registration-access-token client binding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116672",
    "datePublished": "2026-10-27T16:31:48.429Z",
    "dateReserved": "2026-10-26T20:00:59.828Z",
    "dateUpdated": "2026-10-30T20:15:42.022Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41425 (GCVE-0-2026-41425)

Vulnerability from cvelistv5 – Published: 2026-04-24 19:14 – Updated: 2026-04-27 13:35

Title

Authlib: Cross-site request forging when using cache

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-27 13:09 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
authlib	authlib	Affected: < 1.6.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41425",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-27T13:09:15.946604Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-27T13:35:01.596Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth.  This vulnerability is fixed in 1.6.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T19:14:37.904Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgv"
        }
      ],
      "source": {
        "advisory": "GHSA-jj8c-mmj3-mmgv",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib: Cross-site request forging when using cache"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41425",
    "datePublished": "2026-04-24T19:14:37.904Z",
    "dateReserved": "2026-04-20T15:32:33.814Z",
    "dateUpdated": "2026-04-27T13:35:01.596Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-96760 (GCVE-0-2026-96760)

Vulnerability from cvelistv5 – Published: 2026-09-28 19:37 – Updated: 2026-10-01 13:58

Title

Authlib library contains a signature‑verification bypass vulnerability

Summary

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-01 13:57 UTC

CWE

CWE-347 Improper Verification of Cryptographic Signature
CWE-670 Always-Incorrect Control Flow Implementation
CWE-358 Improperly Implemented Security Check for Standard
CWE-20 Improper Input Validation
CWE-347 - Improper Verification of Cryptographic Signature
CWE-670 - Always-Incorrect Control Flow Implementation
CWE-358 - Improperly Implemented Security Check for Standard
CWE-20 - Improper Input Validation

Assigner

certcc CNA under the mitre root

CNA scorecard E 42/100 over 167 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/authlib/authlib
https://kb.cert.org/vuls/id/762428
https://www.kb.cert.org/vuls/id/762428

Impacted products

1 product

Vendor	Product	Version
Authlib	Authlib	Affected: 1.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-28T20:07:57.835Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/762428"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-96760",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-01T13:57:45.534196Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-347",
                "description": "CWE-347 Improper Verification of Cryptographic Signature",
                "lang": "en",
                "type": "CWE"
              },
              {
                "cweId": "CWE-670",
                "description": "CWE-670 Always-Incorrect Control Flow Implementation",
                "lang": "en",
                "type": "CWE"
              },
              {
                "cweId": "CWE-358",
                "description": "CWE-358 Improperly Implemented Security Check for Standard",
                "lang": "en",
                "type": "CWE"
              },
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-01T13:58:32.806Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Authlib",
          "vendor": "Authlib",
          "versions": [
            {
              "status": "affected",
              "version": "1.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-347 Improper Verification of Cryptographic Signature",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-358 Improperly Implemented Security Check for Standard",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-20 Improper Input Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T19:37:58.973Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://github.com/authlib/authlib"
        },
        {
          "url": "https://kb.cert.org/vuls/id/762428"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authlib library contains a signature\u2011verification bypass vulnerability",
      "x_generator": {
        "engine": "VINCE 3.0.49",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-96760"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2026-96760",
    "datePublished": "2026-09-28T19:37:58.973Z",
    "dateReserved": "2026-09-23T15:59:27.145Z",
    "dateUpdated": "2026-10-01T13:58:32.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:12390-1

CVE-2025-62706 (GCVE-0-2025-62706)

CVE-2026-114614 (GCVE-0-2026-114614)

CVE-2026-114615 (GCVE-0-2026-114615)

CVE-2026-114616 (GCVE-0-2026-114616)

CVE-2026-114617 (GCVE-0-2026-114617)

CVE-2026-114618 (GCVE-0-2026-114618)

CVE-2026-114619 (GCVE-0-2026-114619)

CVE-2026-116672 (GCVE-0-2026-116672)

CVE-2026-41425 (GCVE-0-2026-41425)

CVE-2026-96760 (GCVE-0-2026-96760)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour