{"items":[{"id":"CVE-2026-119284","published":"2026-10-29T21:33:16.529Z","updated":"2026-10-30T17:05:38.184Z","title":"joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection","severity":"MEDIUM","score":6.9,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.00192,"kevAdded":null},{"id":"CVE-2026-119283","published":"2026-10-29T21:10:05.490Z","updated":"2026-10-30T17:08:26.483Z","title":"joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption","severity":"HIGH","score":7.5,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.00229,"kevAdded":null},{"id":"CVE-2026-116672","published":"2026-10-27T16:31:48.429Z","updated":"2026-10-30T20:15:42.022Z","title":"Authlib RFC 7592 examples omit registration-access-token client binding","severity":"HIGH","score":8.8,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00274,"kevAdded":null},{"id":"CVE-2026-114620","published":"2026-10-22T21:34:11.909Z","updated":"2026-10-30T20:14:29.752Z","title":"Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF","severity":"MEDIUM","score":5.4,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-114619","published":"2026-10-22T21:31:02.929Z","updated":"2026-10-29T02:40:27.668Z","title":"Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens","severity":"MEDIUM","score":4.6,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-114618","published":"2026-10-22T21:28:37.879Z","updated":"2026-10-29T12:29:17.976Z","title":"Authlib: Default JWT bearer grant accepts assertions for the wrong audience","severity":"MEDIUM","score":6.8,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00351,"kevAdded":null},{"id":"CVE-2026-114617","published":"2026-10-22T21:25:31.732Z","updated":"2026-10-23T15:00:16.051Z","title":"Authlib: ID token can disable its own nonce validation via the nonce_supported claim","severity":"MEDIUM","score":4.2,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00265,"kevAdded":null},{"id":"CVE-2026-114616","published":"2026-10-22T21:14:03.060Z","updated":"2026-10-30T20:07:37.170Z","title":"Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)","severity":"HIGH","score":7.4,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00299,"kevAdded":null},{"id":"CVE-2026-114615","published":"2026-10-22T21:10:02.023Z","updated":"2026-10-29T02:38:05.175Z","title":"Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys","severity":"HIGH","score":7.4,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00213,"kevAdded":null},{"id":"CVE-2026-114614","published":"2026-10-22T21:00:14.354Z","updated":"2026-10-29T13:49:50.607Z","title":"Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts","severity":"LOW","score":2.6,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00273,"kevAdded":null},{"id":"CVE-2026-102946","published":"2026-10-15T18:28:06.913Z","updated":"2026-10-15T19:53:09.069Z","title":"joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json","severity":"CRITICAL","score":9.1,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.00117,"kevAdded":null},{"id":"CVE-2026-104056","published":"2026-10-01T18:03:27.484Z","updated":"2026-10-05T18:21:14.480Z","title":"CVE-2026-104056","severity":"CRITICAL","score":9.8,"vendor":"Authlib","product":"Authlib","kev":false,"epss":0.002,"kevAdded":null},{"id":"CVE-2026-96760","published":"2026-09-28T19:37:58.973Z","updated":"2026-10-01T13:58:32.806Z","title":"Authlib library contains a signature‑verification bypass vulnerability","severity":"CRITICAL","score":9.8,"vendor":"Authlib","product":"Authlib","kev":false,"epss":0.00433,"kevAdded":null},{"id":"CVE-2026-75509","published":"2026-08-24T20:08:07.088Z","updated":"2026-08-25T16:42:19.769Z","title":"joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)","severity":"MEDIUM","score":6.5,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.00124,"kevAdded":null},{"id":"CVE-2026-62995","published":"2026-07-29T18:27:06.518Z","updated":"2026-07-30T14:32:13.148Z","title":"joserfc accepts JWT with padding, leading to JWT malleability","severity":"LOW","score":2.3,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.00145,"kevAdded":null},{"id":"CVE-2026-49852","published":"2026-07-17T19:14:58.019Z","updated":"2026-07-20T14:58:41.701Z","title":"joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)","severity":"HIGH","score":8.7,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.00171,"kevAdded":null},{"id":"CVE-2026-41479","published":"2026-06-22T20:35:13.699Z","updated":"2026-06-23T15:51:57.891Z","title":"Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type","severity":"MEDIUM","score":5.4,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00257,"kevAdded":null},{"id":"CVE-2026-48990","published":"2026-06-17T21:08:10.534Z","updated":"2026-06-18T12:51:59.900Z","title":"joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization","severity":"MEDIUM","score":5.3,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.00237,"kevAdded":null},{"id":"CVE-2026-44681","published":"2026-05-27T19:20:44.122Z","updated":"2026-06-02T16:56:48.017Z","title":"Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization","severity":"MEDIUM","score":6.1,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00249,"kevAdded":null},{"id":"CVE-2026-41425","published":"2026-04-24T19:14:37.904Z","updated":"2026-04-27T13:35:01.596Z","title":"Authlib: Cross-site request forging when using cache","severity":"MEDIUM","score":5.4,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00106,"kevAdded":null},{"id":"CVE-2026-28498","published":"2026-03-16T18:03:28.821Z","updated":"2026-09-10T12:04:48.234Z","title":"Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding","severity":"HIGH","score":8.2,"vendor":"authlib","product":"authlib","kev":false,"epss":0.0024,"kevAdded":null},{"id":"CVE-2026-28490","published":"2026-03-16T17:37:57.425Z","updated":"2026-03-16T18:17:35.003Z","title":"Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle","severity":"HIGH","score":8.3,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-27962","published":"2026-03-16T17:34:38.946Z","updated":"2026-09-10T12:04:56.626Z","title":"Authlib JWS JWK Header Injection: Signature Verification Bypass","severity":"CRITICAL","score":9.1,"vendor":"authlib","product":"authlib","kev":false,"epss":0.0057,"kevAdded":null},{"id":"CVE-2026-28802","published":"2026-03-06T06:44:26.402Z","updated":"2026-09-10T12:05:07.749Z","title":"Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification","severity":"HIGH","score":7.7,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00538,"kevAdded":null},{"id":"CVE-2026-27932","published":"2026-03-03T22:48:21.306Z","updated":"2026-03-04T21:20:55.097Z","title":"joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)","severity":"HIGH","score":7.5,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.00462,"kevAdded":null},{"id":"CVE-2025-68158","published":"2026-01-08T17:58:17.724Z","updated":"2026-03-30T12:20:39.207Z","title":"Authlib: 1-click Account Takeover","severity":"MEDIUM","score":5.7,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00272,"kevAdded":null},{"id":"CVE-2025-65015","published":"2025-11-18T23:07:44.328Z","updated":"2025-11-19T17:12:04.336Z","title":"joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads","severity":"CRITICAL","score":9.2,"vendor":"authlib","product":"joserfc","kev":false,"epss":0.0044,"kevAdded":null},{"id":"CVE-2025-62706","published":"2025-10-22T21:31:10.997Z","updated":"2025-11-03T17:45:27.594Z","title":"Authlib : JWE zip=DEF decompression bomb enables DoS","severity":"MEDIUM","score":6.5,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2025-61920","published":"2025-10-10T19:25:07.679Z","updated":"2025-11-03T17:45:23.708Z","title":"Authlib is vulnerable to Denial of Service via Oversized JOSE Segments","severity":"HIGH","score":7.5,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00638,"kevAdded":null},{"id":"CVE-2025-59420","published":"2025-09-22T17:28:53.869Z","updated":"2025-11-03T17:45:19.901Z","title":"Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)","severity":"HIGH","score":7.5,"vendor":"authlib","product":"authlib","kev":false,"epss":0.00275,"kevAdded":null}]}