Vulnerabilities for Authlib

First version without a known vulnerability: 1.7.1

Details

• GHSA-w8p2-r796-3vmq2026-06-08

  Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

  Fixed in: 1.6.10, 1.7.1

• GHSA-r95x-qfjj-fjj22026-05-13

  Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

  Fixed in: 1.7.1, 1.6.12

• GHSA-jj8c-mmj3-mmgv2026-04-16

  Authlib: Cross-site request forging when using cache

  Fixed in: 1.6.11

• GHSA-m344-f55w-2m6j2026-03-16

  Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

  Fixed in: 1.6.9

• GHSA-7432-952r-cw782026-03-16

  Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

  Fixed in: 1.6.9

• GHSA-wvwj-cvrp-7pv52026-03-16

  Authlib JWS JWK Header Injection: Signature Verification Bypass

  Fixed in: 1.6.9

• GHSA-7wc2-qxgw-g8gg2026-03-04

  Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

  Fixed in: 1.6.7

• GHSA-fg6f-75jq-65232026-01-08

  Authlib has 1-click Account Takeover vulnerability

  Fixed in: 1.6.6

• GHSA-g7f3-828f-7h7m2025-10-10

  Authlib : JWE zip=DEF decompression bomb enables DoS

  Fixed in: 1.6.5

• GHSA-pq5p-34cr-23v92025-10-10

  Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

  Fixed in: 1.6.5

• GHSA-9ggr-2464-2j322025-09-22

  Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

  Fixed in: 1.6.4

• GHSA-5357-c2jx-v7qh2024-06-09

  Authlib has algorithm confusion with asymmetric public keys

  Fixed in: 1.3.1