A
Vendor security profile
authlib
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical3
CISA KEV0
Public exploit6
Patch rate%57
Avg. CVSS8.6
12-month vulnerability rate
0
0
1
0
3
0
0
0
0
1
1
1
CVE KEV
CVE severity distribution
7toplam CVE
Critical3 (43%)
High3 (43%)
Medium1 (14%)
Patch and exploitation view
%57
Verified patch
%0
CISA KEV
%86
Public exploit
4Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
6.1
CVE-2026-49264
OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
O
Patch status unknownEPSS %0
6.8
CVE-2026-49265
OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison
O
Patch status unknownEPSS %0
9.8
CVE-2026-104056
CVE-2026-104056
A
Patch status unknownEPSS %0
9.8
CVE-2026-96760
Authlib library contains a signature‑verification bypass vulnerability
A
Patch status unknownEPSS %0
6.5
CVE-2026-75509
joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
A
Patch status unknownEPSS %0
8.2
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
A
Patch verifiedEPSS %0
9.1
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
A
Patch verifiedEPSS %1
7.7
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
A
Patch verifiedEPSS %1
8.8
CVE-2025-68158
Cross-site request forgery in Authlib
A
Patch verified Public Exploits:1EPSS %0