Threats tagged 'ghsa-9ggr-2464-2j32'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	7.5	CVE-2025-59420Authlib · JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) High7.52025-09-22GCVE DatabaseCVE-2025-59420 Authlib version 1.6.3's JSON Web Signature (JWS) verification improperly accepts tokens containing unknown critical header parameters (`crit`), violating RFC 7515 requirements. This flaw allows tokens with critical headers that strict verifiers reject to be accepted by Authlib, potentially causing authorization bypass in mixed-language environments. The issue is fixed in Authlib 1.6.4. Vulnerability CWE-345 #ghsa-9ggr-2464-2j32 #pypi	GCVE Database	2025-09-22

Page 1 of 1