python-authlib

Python library for OAuth and OpenID Connect

Current: 1.7.2
Candidate: 1.9.5

License: BSD-3-Clause

Build

Target	Result	Last successful version	Succeeded at
rva23	Succeeded	1.7.2	2026-10-08 16:04:49 UTC
rva20	Succeeded	1.7.2	2026-10-08 13:01:10 UTC
x86_64	Succeeded	1.7.2	2026-10-08 06:30:10 UTC

RuntimeDeps

Dependency	Observed source	Current requirement	Candidate requirement
cryptography	50.0.2	any version✓	>=45.0.1✓
joserfc	1.7.4	>=1.6.0✓	>=1.6.8✓
Python	3.14.9	>=3.10✓	>=3.10✓

Advisory · 9

Query ecosystem: PyPIOSV
Query name: authlibOSV
Query version: 1.7.2OSV

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

CVE-2026-114614
Summary
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsOSV
Fixed events
1.8.0OSV OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.273%FIRST
Returned advisory
GHSA-jj7h-c3hg-m23xOSV
Returned advisory
PYSEC-2026-4354OSV
Aliases
GHSA-jj7h-c3hg-m23x, PYSEC-2026-4354OSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:NOSV
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NOSV
References
Advisory · github.com Advisory · nvd.nist.gov Fix · 95ad1f90acf0 Web · github.com
CVE-2026-114615
Summary
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysOSV
Fixed events
1.9.0OSV OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.213%FIRST
Returned advisory
GHSA-7vr2-2fgp-9w7pOSV
Returned advisory
PYSEC-2026-4355OSV
Aliases
GHSA-7vr2-2fgp-9w7p, PYSEC-2026-4355OSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NOSV
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOSV
References
Advisory · github.com Advisory · nvd.nist.gov Fix · e3bd41cb29dc Fix · github.com Web · github.com
CVE-2026-114616
Summary
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)OSV
Fixed events
1.9.1OSV OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.299%FIRST
Returned advisory
GHSA-8m4g-j4wp-wgcgOSV
Returned advisory
PYSEC-2026-4356OSV
Aliases
GHSA-8m4g-j4wp-wgcg, PYSEC-2026-4356OSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NOSV
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOSV
References
Advisory · github.com Advisory · nvd.nist.gov Fix · 4ff30db442c7 Web · github.com
CVE-2026-114617
Summary
Authlib: ID token can disable its own nonce validation via the nonce_supported claimOSV
Fixed events
1.9.0OSV OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.265%FIRST
Returned advisory
GHSA-c5mf-xmp2-59rcOSV
Returned advisory
PYSEC-2026-4357OSV
Aliases
GHSA-c5mf-xmp2-59rc, PYSEC-2026-4357OSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NOSV OSV
References
Advisory · github.com Advisory · nvd.nist.gov Fix · 6563f6f7a8c2 Fix · github.com Web · github.com
CVE-2026-114618
Summary
Authlib: Default JWT bearer grant accepts assertions for the wrong audienceOSV
Fixed events
1.9.0OSV OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.351%FIRST
Returned advisory
GHSA-fch4-3c6x-j4gcOSV
Returned advisory
PYSEC-2026-4358OSV
Aliases
GHSA-fch4-3c6x-j4gc, PYSEC-2026-4358OSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NOSV OSV
References
Advisory · github.com Advisory · nvd.nist.gov Fix · e3bd41cb29dc Fix · github.com Web · github.com
CVE-2026-114619
Summary
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensOSV
Fixed events
1.9.0OSV OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.162%FIRST
Returned advisory
GHSA-q686-2qmg-hqc7OSV
Returned advisory
PYSEC-2026-4359OSV
Aliases
GHSA-q686-2qmg-hqc7, PYSEC-2026-4359OSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NOSV OSV
References
Advisory · github.com Advisory · nvd.nist.gov Fix · e3bd41cb29dc Fix · github.com Web · github.com
CVE-2026-114620
Summary
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFOSV
Fixed events
1.9.0OSV OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.385%FIRST
Returned advisory
GHSA-x4rv-c3wx-4cr8OSV
Returned advisory
PYSEC-2026-4360OSV
Aliases
GHSA-x4rv-c3wx-4cr8, PYSEC-2026-4360OSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NOSV OSV
References
Advisory · github.com Advisory · nvd.nist.gov Fix · 6563f6f7a8c2 Fix · 891e3f10ae59 Fix · github.com Web · github.com
CVE-2026-116672
Summary
Authlib RFC 7592 examples omit registration-access-token client bindingOSV
Fixed events
1.9.1OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.274%FIRST
Returned advisory
GHSA-c73q-w75p-j82vOSV
Aliases
GHSA-c73q-w75p-j82vOSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOSV
References
Advisory · nvd.nist.gov Web · 1bd2a313492c Web · github.com Web · github.com
CVE-2026-96760
Summary
Authlib: empty signatures validation in JWS JSON deserializationOSV
Fixed events
1.9.0OSV
EPSS model date
2026-11-09FIRST
EPSS probability
0.433%FIRST
Returned advisory
GHSA-6v38-4h7w-rj9hOSV
Aliases
GHSA-6v38-4h7w-rj9hOSV
KEV
NoCISA
CVSS_V3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NOSV
References
Advisory · nvd.nist.gov Web · 6c11a02da873 Web · github.com Web · github.com Web · github.com Web · kb.cert.org Web · www.kb.cert.org

Description

Authlib is a Python library for building OAuth and OpenID Connect servers and clients.

Changelog

SPECS: python-authlib: update to 1.7.2 [security-fixes]
Zitao Zhoucdf84e956c062026-06-25 15:35:06 UTC
SPECS: add python-rapidfuzz
PangLARS2bf18ae4f64c2026-04-26 15:54:18 UTC
SPECS: add python-authlib
PangLARS6e9a201f635e2026-04-14 07:32:23 UTC

PR · 3

#1579 Fix security vulnerabilities in certain packages
Leetfs2026-11-07 08:13:24 UTC
#815 SPECS: python-authlib: update to 1.7.2 [security-fixes]
Catherina02026-07-17 13:34:24 UTC
#225 SPECS: add python-codecarbon dependencies
panglars2026-05-25 06:03:43 UTC

Checks

Monitor	Observation	Last checked
Source	Checked	2026-11-10 06:39:44 UTC
Version	Checked	2026-11-10 05:36:01 UTC
Build	Checked	2026-11-10 06:40:42 UTC
GitHub	Checked	2026-11-10 06:32:44 UTC
EOL	Not configured No reliable monitor identity/configuration.	—
LicenseDiff	Checked Compared same-provider, same-project SPDX metadata for this version pair.	2026-11-10 00:45:09 UTC Last attempted2026-11-10 05:30:30 UTC
Dependencies	Checked	2026-11-10 00:45:09 UTC Last attempted2026-11-10 05:31:30 UTC
Advisory	Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.	2026-11-09 19:59:46 UTC Last attempted2026-11-10 00:55:58 UTC
Yanked	Checked	2026-11-10 00:45:09 UTC

Monitor	Checks
Source	6367 Checked 17 CheckFailed
Version	5534 Checked 132 CheckFailed 707 Not configured 3 Partial evidence 8 Input unavailable
Build	6382 Checked 2 Not yet checked
GitHub	6384 Checked
EOL	6260 Not configured 118 Checked 3 Metadata unavailable 3 Input unavailable
LicenseDiff	1665 Not configured 187 Input changed 3175 Not applicable 12 Input unavailable 1134 Checked 207 Metadata unavailable 4 CheckFailed
Dependencies	1852 Not configured 3214 Checked 1248 Metadata unavailable 7 Input unavailable 58 Partial evidence 5 CheckFailed
Advisory	4996 Checked 1375 Not configured 7 Input unavailable 6 Metadata unavailable
Yanked	2248 Not configured 4116 Checked 5 CheckFailed 7 Input unavailable 8 Metadata unavailable