CVE Tools
Track your stack

Authlib

12 CVEs tracked since 2026. Since Oct 2026, none of them reached CISA KEV.

Authlib CVEs per month

Oct 2026 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Authlib CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-10120
2026-113 or fewer

Products

The products that kept showing up in Authlib's monthly top three, with their CVEs summed over those months.

  1. Authlib91 month
  2. Joserfc31 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Authlib.

  1. CVE-2026-119284joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection—
  2. CVE-2026-119283joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption7.5
  3. CVE-2026-116672Authlib RFC 7592 examples omit registration-access-token client binding8.8
  4. CVE-2026-114620Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF5.4
  5. CVE-2026-114619Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens4.6
  6. CVE-2026-114618Authlib: Default JWT bearer grant accepts assertions for the wrong audience6.8
  7. CVE-2026-114617Authlib: ID token can disable its own nonce validation via the nonce_supported claim4.2
  8. CVE-2026-114616Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)7.4
  9. CVE-2026-114615Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys7.4
  10. CVE-2026-114614Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts2.6
  11. CVE-2026-102946joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json9.1
  12. CVE-2026-104056CVE-2026-1040569.8
  13. CVE-2026-96760Authlib library contains a signature‑verification bypass vulnerability9.8
  14. CVE-2026-75509joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)6.5
  15. CVE-2026-62995joserfc accepts JWT with padding, leading to JWT malleability—

The record

Peak rank
#164 in Oct 2026
Busiest month shown
Oct 2026, 12 CVEs
Months with a KEV entry
0 since Oct 2026
Monthly snapshots
1 since 2026
Authlib's full record, month by month