# Authlib vulnerabilities Source: https://junglewise.ai/threats/technologies/authlib-authlib Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 00:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/authlib-authlib.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in Authlib: 0 in the last 7 days and 10 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116672, was published on 27 October 2026. 7 vulnerabilities in the last four weeks, up 133% on the four before (3). 0 critical against 2. ## Counts - Last 7 days: 0 - Last 30 days: 7 - Last 90 days: 10 - All time: 15 (3 critical, 0 exploited in the wild) ## About Authlib Python library for implementing authentication and authorization protocols including OAuth, OpenID Connect, and SAML. ## Latest Authlib vulnerabilities - [CVE-2026-116672: Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 8.8, published 27 Oct 2026) - [CVE-2026-114620: Authlib RFC 9101 server-side request forgery in request_uri parameter](https://junglewise.ai/threats/cve-2026-114620-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 5.4, published 22 Oct 2026) - [CVE-2026-114619: Authlib OpenID Connect scope validation bypass](https://junglewise.ai/threats/cve-2026-114619-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 4.6, published 22 Oct 2026) - [CVE-2026-114618: Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 6.8, published 22 Oct 2026) - [CVE-2026-114617: Authlib nonce validation bypass in OpenID token parsing](https://junglewise.ai/threats/cve-2026-114617-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 4.2, published 22 Oct 2026) - [CVE-2026-114616: Authlib HMAC signature forgery with zero-length keys](https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114615: Authlib HMAC secret confusion in JWT verification](https://junglewise.ai/threats/cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-104056: Authlib OAuth/OIDC discovery metadata cache trust boundary bypass](https://junglewise.ai/threats/cve-2026-104056-authlib-version-1-7-2-and-below-contains-a-vulnerability-where) (info, published 1 Oct 2026) - [Authlib signature verification bypass in JWS JSON deserialization](https://junglewise.ai/threats/duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717) (critical, CVSS 9.8, published 28 Sep 2026) - [CVE-2026-96760: Authlib JSON Web Signature verification bypass](https://junglewise.ai/threats/cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass) (critical, CVSS 9.1, published 28 Sep 2026) - [CVE-2026-44681: Authlib open redirect in OIDC Implicit and Hybrid grants](https://junglewise.ai/threats/cve-2026-44681-authlib-open-redirect-in-oidc-implicit-and-hybrid-grants) (medium, CVSS 6.1, published 27 May 2026) - [CVE-2026-41425: Authlib CSRF in OAuth integrations when using cache storage](https://junglewise.ai/threats/cve-2026-41425-authlib-csrf-in-oauth-integrations-when-using-cache-storage) (medium, CVSS 5.4, published 24 Apr 2026) - [CVE-2026-27962: Authlib JWK Header Injection signature verification bypass](https://junglewise.ai/threats/cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass) (critical, CVSS 9.1, published 16 Mar 2026) - [CVE-2025-68158: PYSEC-2026-1201 - Authlib has 1-click Account Takeover vulnerability](https://junglewise.ai/threats/cve-2025-68158-authlib-has-1-click-account-takeover-vulnerability) (medium, CVSS 5.7, published 8 Jan 2026) - [CVE-2025-62706: PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS](https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos) (medium, CVSS 6.5, published 22 Oct 2025) ## Most severe Authlib vulnerabilities - [Authlib signature verification bypass in JWS JSON deserialization](https://junglewise.ai/threats/duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717) (critical, CVSS 9.8, published 28 Sep 2026) - [CVE-2026-27962: Authlib JWK Header Injection signature verification bypass](https://junglewise.ai/threats/cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass) (critical, CVSS 9.1, published 16 Mar 2026) - [CVE-2026-96760: Authlib JSON Web Signature verification bypass](https://junglewise.ai/threats/cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass) (critical, CVSS 9.1, published 28 Sep 2026) - [CVE-2026-116672: Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 8.8, published 27 Oct 2026) - [CVE-2026-114616: Authlib HMAC signature forgery with zero-length keys](https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114615: Authlib HMAC secret confusion in JWT verification](https://junglewise.ai/threats/cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114618: Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 6.8, published 22 Oct 2026) - [CVE-2025-62706: PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS](https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos) (medium, CVSS 6.5, published 22 Oct 2025) - [CVE-2026-44681: Authlib open redirect in OIDC Implicit and Hybrid grants](https://junglewise.ai/threats/cve-2026-44681-authlib-open-redirect-in-oidc-implicit-and-hybrid-grants) (medium, CVSS 6.1, published 27 May 2026) - [CVE-2025-68158: PYSEC-2026-1201 - Authlib has 1-click Account Takeover vulnerability](https://junglewise.ai/threats/cve-2025-68158-authlib-has-1-click-account-takeover-vulnerability) (medium, CVSS 5.7, published 8 Jan 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up 133% on the four before (3). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 3 | 2 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 6 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Authlib technologies - [Authlib Joserfc](https://junglewise.ai/threats/technologies/joserfc): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Authlib vulnerabilities", https://junglewise.ai/threats/technologies/authlib-authlib, 12 November 2026.