CVE-2026-48817 is a vulnerability in Starlette's HTTPEndpoint where arbitrary HTTP methods are dispatched to endpoint attributes via getattr without validation. If an HTTPEndpoint subclass is registered without explicitly restricting allowed HTTP methods, an attacker can invoke internal methods by sending non-standard HTTP methods matching those method names. This can bypass intended authorization checks. The issue affects Starlette and frameworks built on it, such as FastAPI. A fix is available in version 2.15.0_1.
A vulnerability in Starlette versions >=1.0.3 and <2.15.0 allows an attacker to bypass path-based security checks by sending a malformed HTTP Host header. This causes the reconstructed request.url.path to differ from the actual requested path, potentially bypassing middleware or endpoint security that relies on request.url.path. The vulnerability is mitigated by validating the Host header against RFC 9112 and RFC 3986 grammar or by using a reverse proxy that rejects malformed Host headers.
CVE-2026-44681 is an open redirect vulnerability in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoints. An attacker can cause the authorization server to issue an HTTP 302 redirect to an arbitrary URL by submitting an authorization request that omits the required 'openid' scope. This occurs because the scope validation error redirects to an unvalidated redirect_uri supplied by the attacker. The flaw affects Authlib versions from 2.1.0 up to but not including 2.14.0_4 and is fixed in version 2.14.0_4. The vulnerability enables phishing attacks leveraging the trusted authorization server domain but does not leak tokens or codes directly.
Authlib's OAuth 2.0 authorization endpoint in mcpm versions >=2.1.0 and <2.14.0_3 contains an open redirect vulnerability. This occurs when an unsupported response_type is used along with an attacker-controlled redirect_uri, allowing redirection without client validation or user authentication. The issue is fixed in version 2.14.0_3.
A CSRF vulnerability exists in Authlib's OAuth integrations when using the cache parameter to store auth state. Without cache, SessionMiddleware ties the client to the auth state, preventing CSRF. With cache, the state parameter is fetched from the cache without verifying the client identity, allowing an attacker to forge requests that link their account to a victim's session. This affects all users using the cache for auth state storage. The issue is fixed in version 2.14.0_3.
FastMCP's OpenAPIProvider contains a critical vulnerability in its URL construction logic that allows authenticated users to perform Server-Side Request Forgery (SSRF) and path traversal attacks. The vulnerability arises because path parameters are directly substituted into URL templates without URL encoding, enabling attackers to inject traversal sequences like '../' that escape the intended API path. This leads to unauthorized access to internal backend endpoints with the MCP provider's authentication context.
A vulnerability in the Authlib library versions 2.9.0 up to but not including 2.13.0_2 allows JWT tokens with the header 'alg: none' and an empty signature to bypass signature verification. This flaw was introduced in version 1.6.0 and persists through 1.6.5, causing maliciously crafted tokens to be accepted as valid without proper verification. This can lead to authentication bypass, privilege escalation, and unauthorized access. A fix is available in version 2.13.0_2.
A critical vulnerability in the Authlib Python library's OpenID Connect (OIDC) ID Token validation allows bypassing integrity checks for Access Token and Authorization Code hashes. The flaw causes the library to incorrectly accept tokens with unsupported cryptographic algorithms by returning a successful validation result instead of failing. This fail-open behavior violates OIDC and JWT specifications, enabling attackers to substitute tokens without detection. The issue affects Authlib versions from 2.1.0 up to but not including 2.13.0_3. A patch is available in version 2.13.0_3 that enforces fail-closed behavior on unsupported algorithms.
A cryptographic padding oracle vulnerability exists in the Authlib Python library's implementation of the JWE RSA1_5 key management algorithm. Authlib disables the Bleichenbacher mitigation provided by the underlying cryptography library by raising a distinct exception on invalid padding, creating a reliable exception oracle. This vulnerability is active by default in Authlib versions from 2.1.0 up to but not including 2.13.0_3. The flaw allows attackers to distinguish invalid padding from valid padding with incorrect MAC, potentially enabling cryptographic attacks. A fix is available in Authlib version 2.13.0_3.
Authlib's JWS implementation contains a JWK header injection vulnerability (CVE-2026-27962) that allows an unauthenticated attacker to forge JWT tokens that pass signature verification. This occurs when key=None is passed to JWS deserialization functions, causing the library to trust the attacker-controlled 'jwk' header as the verification key. This violates RFC 7515 and enables authentication and authorization bypass. The vulnerability affects authlib versions >=2.1.0 and <2.13.0_3. A fix is available in version 2.13.0_3.
A vulnerability in Authlib's cache-backed state storage allows Cross-Site Request Forgery (CSRF) leading to a one-click account takeover in applications using the library. The issue arises because the OAuth state parameter stored in cache is not bound to the user's session, enabling attackers to reuse valid state values to hijack authorization flows. This can result in an attacker linking their SSO account to a victim's application account, effectively taking over the victim's account. The flaw affects Authlib versions from 2.1.0 up to but not including 2.12.0. A fix is available in version 2.12.0 that ties the state parameter to the user session, preventing this attack.
Starlette's FileResponse component contains a vulnerability in its HTTP Range header parsing logic that leads to quadratic-time complexity. An unauthenticated attacker can craft a Range header with many small or specially shaped ranges, causing excessive CPU usage and denial of service on endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, as well as frameworks built on Starlette such as FastAPI when serving files. The vulnerability is identified as CVE-2025-62727 and has a CVSS score of 7.5 (high severity). A fix is available in version 2.9.0_1.
Authlib's JWE implementation with 'zip=DEF' (DEFLATE) decompression performs unbounded decompression without output size limits. This allows an attacker who can supply decryptable tokens to craft small ciphertexts that decompress into very large plaintexts, causing excessive memory and CPU usage and resulting in denial of service. The vulnerability affects Authlib versions from 2.1.0 up to but not including 2.9.0. A fix is available in version 2.9.0 that adds a maximum output size limit to prevent decompression bombs.
Starlette versions from 1.0.3 up to but not including 2.6.0_1 have a denial-of-service vulnerability when parsing multipart forms with large files. The issue arises because the main event thread is blocked during file rollover to disk, preventing new connections. The impact is considered low to medium, as the blocking mainly affects systems with slower disk IO. A fix is available in version 2.6.0_1.
A vulnerability in h11 versions before 1.6.0 allows malformed HTTP/1.1 chunked-encoding bodies to be accepted due to lenient parsing of trailing line terminators. This can lead to HTTP request smuggling when combined with a proxy that parses chunked bodies differently. The issue is fixed in h11 version 1.6.0.
Authlib version 1.6.3's JWS verification improperly accepts JSON Web Signatures (JWS) tokens containing unknown critical header parameters (`crit`), violating RFC 7515 requirements. This flaw allows tokens with critical headers that strict verifiers reject to be accepted, potentially causing authorization bypass in mixed-language environments. The vulnerability affects the `authlib.jose.JsonWebSignature.deserialize_compact(...)` API with default configuration. Exploitation can lead to split-brain verification scenarios, enabling replay or privilege escalation if critical security semantics are ignored.
Authlib versions up to 1.6.3 have a vulnerability in their JOSE implementation where oversized JWS/JWT header or signature segments can cause excessive CPU and memory consumption during verification, leading to denial of service. The vulnerability arises because the library accepts unbounded base64url-encoded segments, which can be crafted to span hundreds of megabytes. Later versions with limits on header and signature segment sizes are not affected.
DuckDB introduced block-based encryption on the filesystem starting with version 1.4.0. Several security issues were found in this implementation, including fallback to an insecure random number generator (pcg32), potential removal of memory clearing calls by the compiler, downgrade attacks from GCM to CTR mode bypassing integrity checks, and failure to verify OpenSSL random number generator return values. These vulnerabilities could allow attackers to compromise cryptographic keys, bypass integrity protections, or influence the random number generator state. Version 1.4.2 addresses these issues by disabling the insecure RNG fallback, using secure memory clearing primitives, enforcing cipher specifications with integrity checks, and verifying return codes.
FastMCP's authentication integration with Entra ID allows the MCP server to act both as an OAuth client and authorization server. Due to Entra ID's lack of Dynamic Client Registration support, the FastMCP server uses a static app registration for authorization. After a user consents to this static client, Entra ID sets a persistent authorization cookie. An attacker controlling their own MCP client can exploit this by initiating authorization flows that reuse the victim's consented static client ID, potentially leading to confused deputy account takeover.