Search: CVE-2025-59420

Authlib version 1.6.3's JWS verification does not properly enforce the RFC 7515 requirement to reject tokens with unknown critical header parameters listed in the 'crit' header. This allows tokens with unknown or security-sensitive critical headers (e.g., 'cnf') to be accepted, violating specification semantics. In heterogeneous environments where other strict verifiers reject such tokens, this discrepancy can lead to authorization bypass, replay, or privilege escalation.