Executive brief
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Affected products
- PyPI authlib
Junglewise Threat Intelligence
CVE-2025-59420: PYSEC-2026-1200 - Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
CVE-2025-59420 · Severity: low · CVSS 3.1 · Published 2026-07-07
Vendors: PyPI.
Related threats
- PYSEC-2026-1201 - Authlib has 1-click Account Takeover vulnerability
- PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS
- PYSEC-2026-1203 - Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
- Authlib open redirect in OAuth 2.0 authorization endpoint
- Authlib open redirect in OIDC Implicit and Hybrid grants