authlib
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 19 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from June 9, 2024 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type
Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization
Authlib: Cross-site request forging when using cache
Monitor authlib in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.