Medium
CVE-2026-49265
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 19
Reset filters
Medium
CVE-2026-49264
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation
High
CVE-2026-49852
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)
Medium
CVE-2026-55837
dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Medium
CVE-2025-68158
Authlib has 1-click Account Takeover vulnerability
High
CVE-2025-61920
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Medium
CVE-2025-62706
Authlib : JWE zip=DEF decompression bomb enables DoS
High
CVE-2025-59420
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Medium
CVE-2026-41479
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
Medium
CVE-2026-44681
Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect
Medium
CVE-2026-41425
Authlib: Cross-site request forging when using cache
High
CVE-2026-28490
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
High
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Critical
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
High
CVE-2026-32597
PyJWT accepts unknown `crit` header extensions
High
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
High
CVE-2024-37568
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (T
Medium
CVE-2022-36087
OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI
Low
ghsa-f366-4rvv-95x2
Buffer overflow in deprecated USB HALs and stack overflow in USB enumeration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.