CVE Feed

    Dashboard / CVE / CVE-2024-37568

    CVE-2024-37568

    lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)

    Published:Jun 9, 2024
    Last Modified:Nov 3, 2025
    EPS:Jun 9, 2024
    EPSS Score:0.00099
    CVSS Score:7.5

    Affected Products

    Vendor
    Authlib
    Product
    Authlib
    Vendor
    Lepture
    Product
    Authlib

    Exploits

    https://github.com/lepture/authlib/issues/654https://github.com/lepture/authlib/issues/654

    Related CVEs

    CVE-2026-41479 (CVSS 5.4) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib'…
    CVE-2026-44681 (CVSS 6.1) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unaut…
    CVE-2026-41425 (CVSS 5.4) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF p…
    CVE-2026-28498 (CVSS 8.2) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-l…
    CVE-2026-28490 (CVSS 8.3) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptogra…
    CVE-2026-27962 (CVSS 9.1) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Heade…
    CVE-2026-28802 (CVSS 7.7) — Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before versio…
    CVE-2025-68158 (CVSS 5.7) — Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, ca…
    CVE-2025-62706 (CVSS 6.5) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s J…
    CVE-2025-61920 (CVSS 7.5) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s J…

    References

    https://github.com/lepture/authlib/issues/654
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHJI32SN4FNAUVNALVGOKWHNSQ6XS3M5/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU/
    https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-lepture-authlib-cve-2024-37568
    https://github.com/lepture/authlib/issues/654
    https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHJI32SN4FNAUVNALVGOKWHNSQ6XS3M5/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU/
    https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-lepture-authlib-cve-2024-37568

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High