CVE Tools
Track your stack

Authlib

23 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Authlib, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Authlib CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Authlib CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-091
2025-102
2025-110
2025-120
2026-011
2026-020
2026-034
2026-042
2026-051
2026-061
2026-070
2026-080
2026-091
2026-109
2026-110

Severity

How the 23 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical418%
  • High732%
  • Medium1045%
  • Low15%

Latest CVEs

The 15 most recently published vulnerabilities affecting Authlib.

  1. CVE-2026-116672Authlib RFC 7592 examples omit registration-access-token client binding8.8
  2. CVE-2026-114620Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF5.4
  3. CVE-2026-114619Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens4.6
  4. CVE-2026-114618Authlib: Default JWT bearer grant accepts assertions for the wrong audience6.8
  5. CVE-2026-114617Authlib: ID token can disable its own nonce validation via the nonce_supported claim4.2
  6. CVE-2026-114616Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)7.4
  7. CVE-2026-114615Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys7.4
  8. CVE-2026-114614Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts2.6
  9. CVE-2026-104056CVE-2026-1040569.8
  10. CVE-2026-96760Authlib library contains a signature‑verification bypass vulnerability9.8
  11. CVE-2026-41479Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type5.4
  12. CVE-2026-44681Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization6.1
  13. CVE-2026-41425Authlib: Cross-site request forging when using cache5.4
  14. GHSA-jj8c-mmj3-mmgvAuthlib: Cross-site request forging when using cache—
  15. CVE-2026-28498Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding7.5

Product grouping is registry-driven, with AI assist and human review. How it works