# authlib (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/authlib Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/authlib.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in authlib (PyPI): 0 in the last 7 days and 10 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116672, was published on 27 October 2026. 8 vulnerabilities in the last four weeks, up 300% on the four before (2). 0 critical against 2. ## Counts - Last 7 days: 0 - Last 30 days: 8 - Last 90 days: 10 - All time: 22 (4 critical, 0 exploited in the wild) ## About authlib (PyPI) Python library providing authentication and authorization protocols for applications. ## Latest authlib (PyPI) vulnerabilities - [CVE-2026-116672: Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 8.8, published 27 Oct 2026) - [CVE-2026-114620: Authlib RFC 9101 server-side request forgery in request_uri parameter](https://junglewise.ai/threats/cve-2026-114620-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 5.4, published 22 Oct 2026) - [CVE-2026-114619: Authlib OpenID Connect scope validation bypass](https://junglewise.ai/threats/cve-2026-114619-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 4.6, published 22 Oct 2026) - [CVE-2026-114618: Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 6.8, published 22 Oct 2026) - [CVE-2026-114617: Authlib nonce validation bypass in OpenID token parsing](https://junglewise.ai/threats/cve-2026-114617-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 4.2, published 22 Oct 2026) - [CVE-2026-114616: Authlib HMAC signature forgery with zero-length keys](https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114615: Authlib HMAC secret confusion in JWT verification](https://junglewise.ai/threats/cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114614: Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0…](https://junglewise.ai/threats/cve-2026-114614-authlib-is-a-python-library-which-builds-oauth-and-openid) (low, CVSS 3.1, published 22 Oct 2026) - [Authlib signature verification bypass in JWS JSON deserialization](https://junglewise.ai/threats/duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717) (critical, CVSS 9.8, published 28 Sep 2026) - [CVE-2026-96760: Authlib JSON Web Signature verification bypass](https://junglewise.ai/threats/cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass) (critical, CVSS 9.1, published 28 Sep 2026) - [CVE-2025-61920: PYSEC-2026-1203 - Authlib is vulnerable to Denial of Service via Oversized JOSE Segments](https://junglewise.ai/threats/cve-2025-61920-authlib-is-vulnerable-to-denial-of-service-via-oversized-jose) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2025-59420: PYSEC-2026-1200 - Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)](https://junglewise.ai/threats/cve-2025-59420-authlib-jws-jwt-accepts-unknown-crit-headers-rfc-violation) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2026-41479: Authlib open redirect in OAuth 2.0 authorization endpoint](https://junglewise.ai/threats/cve-2026-41479-authlib-open-redirect-in-oauth-2-0-authorization-endpoint) (medium, CVSS 5.4, published 22 Jun 2026) - [CVE-2026-44681: Authlib open redirect in OIDC Implicit and Hybrid grants](https://junglewise.ai/threats/cve-2026-44681-authlib-open-redirect-in-oidc-implicit-and-hybrid-grants) (medium, CVSS 6.1, published 27 May 2026) - [CVE-2026-41425: Authlib CSRF in OAuth integrations when using cache storage](https://junglewise.ai/threats/cve-2026-41425-authlib-csrf-in-oauth-integrations-when-using-cache-storage) (medium, CVSS 5.4, published 24 Apr 2026) - [CVE-2026-28498: Authlib fail-open cryptographic verification in OIDC hash binding](https://junglewise.ai/threats/cve-2026-28498-authlib-fail-open-cryptographic-verification-in-oidc-hash-binding) (high, CVSS 7.5, published 16 Mar 2026) - [CVE-2026-28490: Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle](https://junglewise.ai/threats/cve-2026-28490-authlib-vulnerable-to-jwe-rsa1-5-bleichenbacher-padding-oracle) (medium, CVSS 4, published 16 Mar 2026) - [CVE-2026-27962: Authlib JWK Header Injection signature verification bypass](https://junglewise.ai/threats/cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass) (critical, CVSS 9.1, published 16 Mar 2026) - [CVE-2026-28802: Authlib signature verification bypass via none algorithm in JWT](https://junglewise.ai/threats/cve-2026-28802-authlib-signature-verification-bypass-via-none-algorithm-in-jwt) (critical, CVSS 9.8, published 6 Mar 2026) - [CVE-2025-68158: PYSEC-2026-1201 - Authlib has 1-click Account Takeover vulnerability](https://junglewise.ai/threats/cve-2025-68158-authlib-has-1-click-account-takeover-vulnerability) (medium, CVSS 5.7, published 8 Jan 2026) - [CVE-2025-62706: PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS](https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos) (medium, CVSS 6.5, published 22 Oct 2025) - [CVE-2024-37568: Authlib has algorithm confusion with asymmetric public keys](https://junglewise.ai/threats/cve-2024-37568-authlib-has-algorithm-confusion-with-asymmetric-public-keys) (low, CVSS 3.1, published 9 Jun 2024) ## Most severe authlib (PyPI) vulnerabilities - [CVE-2026-28802: Authlib signature verification bypass via none algorithm in JWT](https://junglewise.ai/threats/cve-2026-28802-authlib-signature-verification-bypass-via-none-algorithm-in-jwt) (critical, CVSS 9.8, published 6 Mar 2026) - [Authlib signature verification bypass in JWS JSON deserialization](https://junglewise.ai/threats/duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717) (critical, CVSS 9.8, published 28 Sep 2026) - [CVE-2026-27962: Authlib JWK Header Injection signature verification bypass](https://junglewise.ai/threats/cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass) (critical, CVSS 9.1, published 16 Mar 2026) - [CVE-2026-96760: Authlib JSON Web Signature verification bypass](https://junglewise.ai/threats/cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass) (critical, CVSS 9.1, published 28 Sep 2026) - [CVE-2026-116672: Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 8.8, published 27 Oct 2026) - [CVE-2026-28498: Authlib fail-open cryptographic verification in OIDC hash binding](https://junglewise.ai/threats/cve-2026-28498-authlib-fail-open-cryptographic-verification-in-oidc-hash-binding) (high, CVSS 7.5, published 16 Mar 2026) - [CVE-2026-114616: Authlib HMAC signature forgery with zero-length keys](https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114615: Authlib HMAC secret confusion in JWT verification](https://junglewise.ai/threats/cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114618: Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 6.8, published 22 Oct 2026) - [CVE-2025-62706: PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS](https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos) (medium, CVSS 6.5, published 22 Oct 2025) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up 300% on the four before (2). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 2 | 2 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 7 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "authlib (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/authlib, 13 November 2026.