OAuthlib contains a vulnerability in its token grant handlers where an authenticated client can supply a different client_id in the token request body, causing authorization checks to be performed under that other client identity. This affects the client_credentials and password grant flows when the application validator uses the client_id argument for authorization. The flaw allows a lower-privilege client to obtain tokens with broader scopes or grant types assigned to another client. The issue arises because OAuthlib does not require the authenticated client's client_id to match the client_id parameter in the request body during grant and scope validation.
The joserfc library version 1.7.4 has a vulnerability in its compact JWS size guard. It allocates attacker-controlled memory segments before validating their size, leading to excessive memory allocation prior to rejecting oversized inputs. This can cause increased memory usage and potentially trigger MemoryError exceptions under constrained environments.
The joserfc library's JWE General JSON parser accepts an attacker-controlled recipients array of unlimited length and performs a costly RSA private-key decryption operation for each recipient. This lack of a cap on recipient count enables an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON document with many recipients. The library's documented mitigation option does not reduce CPU usage, making the issue exploitable. A fix is available in version 5.0.0.
The Kaskade OAuth 2.0 Dynamic Client Registration Management implementation in Authlib has a security flaw where example code omits the critical check binding the registration_access_token to the specific client. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and access, modify, or delete that client's registration. The vulnerability affects versions 4.0.4 and later. The CVSS 3.1 score is 8.8 (high severity).
pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process has quadratic time complexity relative to the mantissa size, causing excessive CPU consumption during decoding. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. The vulnerability can be triggered by attacker-controlled ASN.1 input containing REAL values. A fix is available in pyasn1 version 0.6.5.
pyasn1 versions through 0.6.4 have a vulnerability in decoding constructed BIT STRING values where CPU consumption grows quadratically with input size due to repeated shifting and copying during decoding. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. No confidentiality or integrity impact is reported. The vulnerability has a CVSS score of 7.5, indicating high severity.
pyasn1 versions 0.6.4 and earlier contain a denial-of-service vulnerability due to quadratic-time complexity when decoding constructed OCTET STRINGs, certain constructed character strings, and indefinite-length ANY types. This occurs because the decoder repeatedly copies accumulated fragments, causing CPU exhaustion with crafted ASN.1 inputs. The issue affects BER and CER decoding paths and certain non-conforming DER inputs when using an asn1Spec. No confidentiality or integrity impacts are reported. The vulnerability has a CVSS score of 7.5 (high severity).
CVE-2026-119194 is a vulnerability in the pyasn1 library used by mistral-vibe that causes quadratic CPU usage when decoding attacker-controlled BER, CER, or DER data without an ASN.1 schema. An attacker can craft inputs with many distinct long tag IDs that cause excessive CPU consumption, potentially leading to denial of service by exhausting CPU resources. The issue arises from the decoder's handling of TagSet insertion, which grows quadratically with the number of distinct tags. No confidentiality or integrity impact is reported.