# Authlib vulnerabilities Source: https://junglewise.ai/threats/vendors/authlib Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/authlib.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 21 vulnerabilities in Authlib: 0 in the last 7 days and 13 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119284, was published on 29 October 2026. 9 vulnerabilities in the last four weeks, up 200% on the four before (3). 0 critical against 2. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 9 - Last 90 days: 13 - All time: 21 (3 critical, 0 exploited in the wild) ## About Authlib Authlib is a Python library that implements various authentication and authorization protocols, including OAuth and OpenID Connect. ## Latest Authlib vulnerabilities - [CVE-2026-119284: joserfc memory exhaustion in compact JWS deserialization](https://junglewise.ai/threats/cve-2026-119284-joserfc-is-a-python-library-that-provides-an-implementation-of) (medium, CVSS 4, published 29 Oct 2026) - [CVE-2026-119283: joserfc JWE denial of service via unlimited recipients](https://junglewise.ai/threats/cve-2026-119283-joserfc-is-a-python-library-that-provides-an-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-116672: Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 8.8, published 27 Oct 2026) - [CVE-2026-114620: Authlib RFC 9101 server-side request forgery in request_uri parameter](https://junglewise.ai/threats/cve-2026-114620-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 5.4, published 22 Oct 2026) - [CVE-2026-114619: Authlib OpenID Connect scope validation bypass](https://junglewise.ai/threats/cve-2026-114619-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 4.6, published 22 Oct 2026) - [CVE-2026-114618: Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 6.8, published 22 Oct 2026) - [CVE-2026-114617: Authlib nonce validation bypass in OpenID token parsing](https://junglewise.ai/threats/cve-2026-114617-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 4.2, published 22 Oct 2026) - [CVE-2026-114616: Authlib HMAC signature forgery with zero-length keys](https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114615: Authlib HMAC secret confusion in JWT verification](https://junglewise.ai/threats/cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-104056: Authlib OAuth/OIDC discovery metadata cache trust boundary bypass](https://junglewise.ai/threats/cve-2026-104056-authlib-version-1-7-2-and-below-contains-a-vulnerability-where) (info, published 1 Oct 2026) - [Authlib signature verification bypass in JWS JSON deserialization](https://junglewise.ai/threats/duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717) (critical, CVSS 9.8, published 28 Sep 2026) - [CVE-2026-96760: Authlib JSON Web Signature verification bypass](https://junglewise.ai/threats/cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass) (critical, CVSS 9.1, published 28 Sep 2026) - [CVE-2026-75509: authlib joserfc issuer validation bypass in JWT claims](https://junglewise.ai/threats/cve-2026-75509-authlib-joserfc-issuer-validation-bypass-in-jwt-claims) (medium, CVSS 6.5, published 24 Aug 2026) - [CVE-2026-62995: authlib joserfc token malleability via trailing padding](https://junglewise.ai/threats/cve-2026-62995-authlib-joserfc-token-malleability-via-trailing-padding) (info, CVSS 2.3, published 29 Jul 2026) - [CVE-2026-49852: authlib joserfc authentication bypass via empty HMAC key](https://junglewise.ai/threats/cve-2026-49852-authlib-joserfc-authentication-bypass-via-empty-hmac-key) (high, CVSS 4, published 17 Jul 2026) - [CVE-2026-48990: authlib joserfc resource exhaustion via oversized RFC7797 payloads](https://junglewise.ai/threats/cve-2026-48990-authlib-joserfc-resource-exhaustion-via-oversized-rfc7797) (medium, CVSS 5.3, published 17 Jun 2026) - [CVE-2026-44681: Authlib open redirect in OIDC Implicit and Hybrid grants](https://junglewise.ai/threats/cve-2026-44681-authlib-open-redirect-in-oidc-implicit-and-hybrid-grants) (medium, CVSS 6.1, published 27 May 2026) - [CVE-2026-41425: Authlib CSRF in OAuth integrations when using cache storage](https://junglewise.ai/threats/cve-2026-41425-authlib-csrf-in-oauth-integrations-when-using-cache-storage) (medium, CVSS 5.4, published 24 Apr 2026) - [CVE-2026-27962: Authlib JWK Header Injection signature verification bypass](https://junglewise.ai/threats/cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass) (critical, CVSS 9.1, published 16 Mar 2026) - [CVE-2025-68158: PYSEC-2026-1201 - Authlib has 1-click Account Takeover vulnerability](https://junglewise.ai/threats/cve-2025-68158-authlib-has-1-click-account-takeover-vulnerability) (medium, CVSS 5.7, published 8 Jan 2026) - [CVE-2025-62706: PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS](https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos) (medium, CVSS 6.5, published 22 Oct 2025) ## Most severe Authlib vulnerabilities - [Authlib signature verification bypass in JWS JSON deserialization](https://junglewise.ai/threats/duplicate-advisory-authlib-empty-signatures-validation-in-jws-json-98257717) (critical, CVSS 9.8, published 28 Sep 2026) - [CVE-2026-27962: Authlib JWK Header Injection signature verification bypass](https://junglewise.ai/threats/cve-2026-27962-authlib-jwk-header-injection-signature-verification-bypass) (critical, CVSS 9.1, published 16 Mar 2026) - [CVE-2026-96760: Authlib JSON Web Signature verification bypass](https://junglewise.ai/threats/cve-2026-96760-authlib-v1-7-2-and-below-contains-a-signature-verification-bypass) (critical, CVSS 9.1, published 28 Sep 2026) - [CVE-2026-116672: Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 8.8, published 27 Oct 2026) - [CVE-2026-119283: joserfc JWE denial of service via unlimited recipients](https://junglewise.ai/threats/cve-2026-119283-joserfc-is-a-python-library-that-provides-an-implementation-of) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-114616: Authlib HMAC signature forgery with zero-length keys](https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-114615: Authlib HMAC secret confusion in JWT verification](https://junglewise.ai/threats/cve-2026-114615-authlib-is-a-python-library-which-builds-oauth-and-openid) (high, CVSS 7.4, published 22 Oct 2026) - [CVE-2026-49852: authlib joserfc authentication bypass via empty HMAC key](https://junglewise.ai/threats/cve-2026-49852-authlib-joserfc-authentication-bypass-via-empty-hmac-key) (high, CVSS 4, published 17 Jul 2026) - [CVE-2026-114618: Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid) (medium, CVSS 6.8, published 22 Oct 2026) - [CVE-2025-62706: PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS](https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos) (medium, CVSS 6.5, published 22 Oct 2025) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 200% on the four before (3). 0 critical against 2. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 3 | 2 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 6 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Authlib technologies - [Authlib](https://junglewise.ai/threats/technologies/authlib-authlib): 15 vulnerabilities - [Authlib Joserfc](https://junglewise.ai/threats/technologies/joserfc): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Authlib vulnerabilities", https://junglewise.ai/threats/vendors/authlib, 12 November 2026.