Advisories · Technology
authlib joserfc.
Every CVE that names authlib joserfc among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json
- authlib joserfc
- Authentication bypass
- Weak cryptography or TLS
- CVSS 6.5 Medium
joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
- authlib joserfc
- Authentication bypass
- CWE-345
- CVSS 2.3 Low
joserfc accepts JWT with padding, leading to JWT malleability
- authlib joserfc
- CWE-345