AU
Product
authlib
22
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 6High 6Medium 9Low 1
Watch
Add authlib to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-104056 | 9.8 | Oct 1 | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding Affected: 1.7.2 |
| CVE-2026-96760 | 9.8 | Sep 28 | Authlib library contains a signature‑verification bypass vulnerability Affected: 1.7.2 |
| CVE-2026-28802 | 9.8 | Mar 6 | Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification Affected: >= 1.6.5, < 1.6.7 |
| CVE-2026-114616 New | 9.1 | Oct 22 | Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) Affected: < 1.9.1 |
| CVE-2026-114615 New | 9.1 | Oct 22 | Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys Affected: >= 1.3.1, < 1.9.0 |
| CVE-2026-27962 | 9.1 | Mar 16 | Authlib JWS JWK Header Injection: Signature Verification Bypass Affected: < 1.6.9 |
Showing 6