VulertSecurity VulertSecurity

Vulnerability Database · PyPI · authlib · Version

authlib 0.5.0

0.5.0 is affected by 24 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 1.9.1.

Critical 2 High 8 Medium 9 Low 0 Unrated 5

All authlib versions & vulnerabilities → Search the database for this package →
Released 11 Feb 2018 Licence LGPL-3.0 Also known from other sources 20 Newer releases 65 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

authlib 0.5.0 vulnerabilities

24 vulnerabilities cover authlib 0.5.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-27962: Authlib JWS JWK Header Injection Vulnerability Leading to Signature Verification Bypass 9.1 critical 1.6.9 29 Jun 2026
CVE-2026-27962: Authlib JWS JWK Header Injection Vulnerability Leading to Signature Verification Bypass 9.1 critical 1.6.9 16 Mar 2026
CVE-2026-28490: Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle 8.3 high 1.6.9 16 Mar 2026
CVE-2026-28498: Authlib Critical Fail-Open Vulnerability in OIDC Hash Binding 8.2 high 1.6.9 16 Mar 2026
CVE-2025-61920: Authlib Denial of Service via Oversized JOSE Segments 7.5 high 1.6.5 07 Jul 2026
CVE-2025-59420: Authlib JWS/JWT Accepts Unknown Critical Headers Leading to Possible Authorization Bypass 7.5 high 1.6.4 07 Jul 2026
CVE-2026-28498: Authlib Package Vulnerability in OpenID Connect ID Token Validation 7.5 high 1.6.9 16 Mar 2026
CVE-2025-61920: Authlib Denial of Service via Oversized JOSE Segments 7.5 high 1.6.5 10 Oct 2025
CVE-2025-59420: Authlib JWS/JWT Accepts Unknown Critical Headers Leading to Potential Authorization Bypass 7.5 high 1.6.4 22 Sep 2025
CVE-2024-37568: Authlib Algorithm Confusion with Asymmetric Public Keys 7.4 high 1.3.1 09 Jun 2024
CVE-2025-62706: Authlib Denial of Service Vulnerability via JWE zip=DEF Decompression Bomb 6.5 medium 1.6.5 07 Jul 2026
CVE-2026-28490: Authlib Package Suffers from Cryptographic Padding Oracle Vulnerability 6.5 medium 1.6.9 16 Mar 2026
Denial of Service Vulnerability in Authlib: Unbounded DEFLATE Decompression 6.5 medium 1.6.5 10 Oct 2025
CVE-2026-44681: Authlib OpenID Grant Unauthenticated Open Redirect Vulnerability 6.1 medium 1.6.12 27 May 2026
CVE-2025-68158: Authlib 1-Click Account Takeover Vulnerability 5.7 medium 1.6.6 08 Jan 2026
CVE-2026-41479: Authlib Open Redirect Vulnerability in OAuth 2.0 Authorization Endpoint 5.4 medium 1.6.10 22 Jun 2026
CVE-2026-41479: Authlib OAuth 2.0 Open Redirect Vulnerability 5.4 medium 1.6.10 08 Jun 2026
CVE-2026-41425: Authlib CSRF Vulnerability in Cache Feature 5.4 medium 1.6.11 24 Apr 2026
CSRF Vulnerability in Authlib Package: Lack of Protection in Cache Feature 5.4 medium 1.6.11 16 Apr 2026
CVE-2026-28498: Authlib Package Vulnerability Leading to Potential Security Risks N/A unrated 1.6.6+echo.1 19 Apr 2026
CVE-2026-28802: Authlib Package Vulnerability Leading to Potential Security Risks N/A unrated 1.6.6+echo.1 19 Apr 2026
CVE-2026-28490: Authlib Package Vulnerability Leading to Potential Security Risks N/A unrated 1.6.6+echo.1 19 Apr 2026
CVE-2026-27962: Authlib Package Vulnerability Leading to Potential Security Breach N/A unrated 1.6.6+echo.1 19 Apr 2026
CVE-2024-37568: Vulnerability in authlib - Algorithm Confusion with Asymmetric Public Keys N/A unrated 1.3.1 09 Jun 2024

Looking for another version, or everything Vulert holds for authlib?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About authlib 0.5.0

Is authlib 0.5.0 vulnerable?

Yes. 24 vulnerabilities in the Vulert database cover authlib 0.5.0: 2 critical, 8 high, 9 medium and 0 low, plus 5 not yet rated. The upgrade Vulert recommends is 1.9.1, and each entry above names the fixed version to move to.

Which version of authlib should I use instead of 0.5.0?

1.9.1 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 0.5.0 the latest release of authlib?

No. 0.5.0 was published 11 Feb 2018, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor authlib for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the authlib version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.