CVE Feed

    Dashboard / CVE / CVE-2025-59420

    CVE-2025-59420

    Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.

    Published:Sep 22, 2025
    Last Modified:Nov 3, 2025
    EPS:Sep 22, 2025
    EPSS Score:0.00041
    CVSS Score:7.5

    Affected Products

    Vendor
    Authlib
    Product
    Authlib

    Exploits

    https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32

    Related CVEs

    CVE-2026-41479 (CVSS 5.4) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib'…
    CVE-2026-44681 (CVSS 6.1) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unaut…
    CVE-2026-41425 (CVSS 5.4) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF p…
    CVE-2026-28498 (CVSS 8.2) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-l…
    CVE-2026-28490 (CVSS 8.3) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptogra…
    CVE-2026-27962 (CVSS 9.1) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Heade…
    CVE-2026-28802 (CVSS 7.7) — Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before versio…
    CVE-2025-68158 (CVSS 5.7) — Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, ca…
    CVE-2025-62706 (CVSS 6.5) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s J…
    CVE-2025-61920 (CVSS 7.5) — Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s J…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High