Vulnerabilities for Authlib

First version without a known vulnerability: 1.9.1

Details

• GHSA-c73q-w75p-j82v2026-10-30

  Authlib RFC 7592 examples omit registration-access-token client binding

  Fixed in: 1.9.1

• GHSA-8m4g-j4wp-wgcg2026-10-27

  Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

  Fixed in: 1.9.1

• GHSA-x4rv-c3wx-4cr82026-10-27

  Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

  Fixed in: 1.9.0

• GHSA-c5mf-xmp2-59rc2026-10-27

  Authlib: ID token can disable its own nonce validation via the nonce_supported claim

  Fixed in: 1.9.0

• GHSA-fch4-3c6x-j4gc2026-10-27

  Authlib: Default JWT bearer grant accepts assertions for the wrong audience

  Fixed in: 1.9.0

• GHSA-q686-2qmg-hqc72026-10-27

  Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

  Fixed in: 1.9.0

• GHSA-7vr2-2fgp-9w7p2026-10-27

  Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

  Fixed in: 1.9.0

• GHSA-jj7h-c3hg-m23x2026-10-27

  Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

  Fixed in: 1.8.0

• GHSA-6v38-4h7w-rj9h2026-10-27

  Authlib: empty signatures validation in JWS JSON deserialization

  Fixed in: 1.9.0

• GHSA-w8p2-r796-3vmq2026-06-08

  Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type

  Fixed in: 1.6.10, 1.7.1

• GHSA-r95x-qfjj-fjj22026-05-13

  Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

  Fixed in: 1.7.1, 1.6.12

• GHSA-jj8c-mmj3-mmgv2026-04-16

  Authlib: Cross-site request forging when using cache

  Fixed in: 1.6.11

• GHSA-m344-f55w-2m6j2026-03-16

  Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

  Fixed in: 1.6.9

• GHSA-7432-952r-cw782026-03-16

  Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

  Fixed in: 1.6.9

• GHSA-wvwj-cvrp-7pv52026-03-16

  Authlib JWS JWK Header Injection: Signature Verification Bypass

  Fixed in: 1.6.9

• GHSA-7wc2-qxgw-g8gg2026-03-04

  Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification

  Fixed in: 1.6.7

• GHSA-fg6f-75jq-65232026-01-08

  Authlib has 1-click Account Takeover vulnerability

  Fixed in: 1.6.6

• GHSA-g7f3-828f-7h7m2025-10-10

  Authlib : JWE zip=DEF decompression bomb enables DoS

  Fixed in: 1.6.5

• GHSA-pq5p-34cr-23v92025-10-10

  Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

  Fixed in: 1.6.5

• GHSA-9ggr-2464-2j322025-09-22

  Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

  Fixed in: 1.6.4

• GHSA-5357-c2jx-v7qh2024-06-09

  Authlib has algorithm confusion with asymmetric public keys

  Fixed in: 1.3.1