{"schema_version":1,"title":"Authlib vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 15 vulnerabilities in Authlib: 0 in the last 7 days and 10 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116672, was published on 27 October 2026. 7 vulnerabilities in the last four weeks, up 133% on the four before (3). 0 critical against 2.","url":"https://junglewise.ai/threats/technologies/authlib-authlib","json_url":"https://junglewise.ai/threats/technologies/authlib-authlib.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/authlib-authlib","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":15,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":7,"last_90_days":10,"last_365_days":14},"latest":[{"cve":"CVE-2026-116672","cvss":8.8,"epss":0.0027,"slug":"cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib client configuration endpoint authorization bypass","severity":"high","exploited":false,"published_at":"2026-10-27T17:16:59.14+00:00","url":"https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114620","cvss":5.4,"epss":0.0039,"slug":"cve-2026-114620-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib RFC 9101 server-side request forgery in request_uri parameter","severity":"medium","exploited":false,"published_at":"2026-10-22T22:18:05.09+00:00","url":"https://junglewise.ai/threats/cve-2026-114620-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114619","cvss":4.6,"epss":0.0016,"slug":"cve-2026-114619-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib OpenID Connect scope validation bypass","severity":"medium","exploited":false,"published_at":"2026-10-22T22:18:04.93+00:00","url":"https://junglewise.ai/threats/cve-2026-114619-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114618","cvss":6.8,"epss":0.0035,"slug":"cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib JWT Bearer Grant audience validation bypass","severity":"medium","exploited":false,"published_at":"2026-10-22T22:18:04.747+00:00","url":"https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114617","cvss":4.2,"epss":0.0027,"slug":"cve-2026-114617-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib nonce validation bypass in OpenID token parsing","severity":"medium","exploited":false,"published_at":"2026-10-22T22:18:04.58+00:00","url":"https://junglewise.ai/threats/cve-2026-114617-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114616","cvss":7.4,"epss":0.003,"slug":"cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib HMAC signature forgery with zero-length keys","severity":"high","exploited":false,"published_at":"2026-10-22T22:18:04.42+00:00","url":"https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114615","cvss":7.4,"epss":0.0021,"slug":"cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib HMAC secret confusion in JWT verification","severity":"high","exploited":false,"published_at":"2026-10-22T22:18:04.257+00:00","url":"https://junglewise.ai/threats/cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-104056","epss":0.001,"slug":"cve-2026-104056-authlib-version-1-7-2-and-below-contains-a-vulnerability-where","title":"Authlib OAuth/OIDC discovery metadata cache trust boundary bypass","severity":"info","exploited":false,"published_at":"2026-10-01T19:17:19.033+00:00","url":"https://junglewise.ai/threats/cve-2026-104056-authlib-version-1-7-2-and-below-contains-a-vulnerability-where"},{"cvss":9.8,"slug":"duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717","title":"Authlib signature verification bypass in JWS JSON deserialization","severity":"critical","exploited":false,"published_at":"2026-09-28T21:31:18+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717"},{"cve":"CVE-2026-96760","cvss":9.1,"epss":0.0043,"slug":"cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass","title":"Authlib JSON Web Signature verification bypass","severity":"critical","exploited":false,"published_at":"2026-09-28T20:17:11.703+00:00","url":"https://junglewise.ai/threats/cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass"},{"cve":"CVE-2026-44681","cvss":6.1,"epss":0.0029,"slug":"cve-2026-44681-authlib-open-redirect-in-oidc-implicit-and-hybrid-grants","title":"Authlib open redirect in OIDC Implicit and Hybrid grants","severity":"medium","exploited":false,"published_at":"2026-05-27T20:16:37.463+00:00","url":"https://junglewise.ai/threats/cve-2026-44681-authlib-open-redirect-in-oidc-implicit-and-hybrid-grants"},{"cve":"CVE-2026-41425","cvss":5.4,"epss":0.0011,"slug":"cve-2026-41425-authlib-csrf-in-oauth-integrations-when-using-cache-storage","title":"Authlib CSRF in OAuth integrations when using cache storage","severity":"medium","exploited":false,"published_at":"2026-04-24T20:16:27.107+00:00","url":"https://junglewise.ai/threats/cve-2026-41425-authlib-csrf-in-oauth-integrations-when-using-cache-storage"},{"cve":"CVE-2026-27962","cvss":9.1,"epss":0.0056,"slug":"cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass","title":"Authlib JWK Header Injection signature verification bypass","severity":"critical","exploited":false,"published_at":"2026-03-16T18:16:07.383+00:00","url":"https://junglewise.ai/threats/cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass"},{"cve":"CVE-2025-68158","cvss":5.7,"epss":0.0027,"slug":"cve-2025-68158-authlib-has-1-click-account-takeover-vulnerability","title":"PYSEC-2026-1201 - Authlib has 1-click Account Takeover vulnerability","severity":"medium","exploited":false,"published_at":"2026-01-08T18:15:59.06+00:00","url":"https://junglewise.ai/threats/cve-2025-68158-authlib-has-1-click-account-takeover-vulnerability"},{"cve":"CVE-2025-62706","cvss":6.5,"epss":0.0046,"slug":"cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos","title":"PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS","severity":"medium","exploited":false,"published_at":"2025-10-22T22:15:35.557+00:00","url":"https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":2,"exploited":0,"vulnerabilities":3},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Authlib Joserfc","slug":"joserfc","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/joserfc"}],"technology":{"hub":true,"name":"Authlib","slug":"authlib-authlib","vendor":{"hub":true,"name":"Authlib","slug":"authlib","url":"https://junglewise.ai/threats/vendors/authlib"},"aliases":[],"category":"library","description":"Python library for implementing authentication and authorization protocols including OAuth, OpenID Connect, and SAML.","url":"https://junglewise.ai/threats/technologies/authlib-authlib"},"most_severe":[{"cvss":9.8,"slug":"duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717","title":"Authlib signature verification bypass in JWS JSON deserialization","severity":"critical","exploited":false,"published_at":"2026-09-28T21:31:18+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717"},{"cve":"CVE-2026-27962","cvss":9.1,"epss":0.0056,"slug":"cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass","title":"Authlib JWK Header Injection signature verification bypass","severity":"critical","exploited":false,"published_at":"2026-03-16T18:16:07.383+00:00","url":"https://junglewise.ai/threats/cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass"},{"cve":"CVE-2026-96760","cvss":9.1,"epss":0.0043,"slug":"cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass","title":"Authlib JSON Web Signature verification bypass","severity":"critical","exploited":false,"published_at":"2026-09-28T20:17:11.703+00:00","url":"https://junglewise.ai/threats/cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass"},{"cve":"CVE-2026-116672","cvss":8.8,"epss":0.0027,"slug":"cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib client configuration endpoint authorization bypass","severity":"high","exploited":false,"published_at":"2026-10-27T17:16:59.14+00:00","url":"https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114616","cvss":7.4,"epss":0.003,"slug":"cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib HMAC signature forgery with zero-length keys","severity":"high","exploited":false,"published_at":"2026-10-22T22:18:04.42+00:00","url":"https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114615","cvss":7.4,"epss":0.0021,"slug":"cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib HMAC secret confusion in JWT verification","severity":"high","exploited":false,"published_at":"2026-10-22T22:18:04.257+00:00","url":"https://junglewise.ai/threats/cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2026-114618","cvss":6.8,"epss":0.0035,"slug":"cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid","title":"Authlib JWT Bearer Grant audience validation bypass","severity":"medium","exploited":false,"published_at":"2026-10-22T22:18:04.747+00:00","url":"https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid"},{"cve":"CVE-2025-62706","cvss":6.5,"epss":0.0046,"slug":"cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos","title":"PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS","severity":"medium","exploited":false,"published_at":"2025-10-22T22:15:35.557+00:00","url":"https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos"},{"cve":"CVE-2026-44681","cvss":6.1,"epss":0.0029,"slug":"cve-2026-44681-authlib-open-redirect-in-oidc-implicit-and-hybrid-grants","title":"Authlib open redirect in OIDC Implicit and Hybrid grants","severity":"medium","exploited":false,"published_at":"2026-05-27T20:16:37.463+00:00","url":"https://junglewise.ai/threats/cve-2026-44681-authlib-open-redirect-in-oidc-implicit-and-hybrid-grants"},{"cve":"CVE-2025-68158","cvss":5.7,"epss":0.0027,"slug":"cve-2025-68158-authlib-has-1-click-account-takeover-vulnerability","title":"PYSEC-2026-1201 - Authlib has 1-click Account Takeover vulnerability","severity":"medium","exploited":false,"published_at":"2026-01-08T18:15:59.06+00:00","url":"https://junglewise.ai/threats/cve-2025-68158-authlib-has-1-click-account-takeover-vulnerability"}],"generated_at":"2026-11-12T00:07:00.154427+00:00"}