CVE-2025-59420: authlib
Vulnerability summary
CVE-2025-59420 is a high (CVSS 7.5) vulnerability in authlib. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 22-09-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAuthlib
Maturity: poc
Weaknesses
CWE · root cause- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Chainguard6 products
- mlflow< 3.4.0-r1
- mlflow-iamguarded-compat< 3.4.0-r1
- open-webui< 0.6.30-r1
- open-webui-compat< 0.6.30-r1
- pgadmin4< 9.8-r1
Wolfi4 products
- mlflow< 3.4.0-r1
- mlflow-iamguarded-compat< 3.4.0-r1
- open-webui< 0.6.30-r1
- open-webui-compat< 0.6.30-r1
Authlib1 product
- authlib< 1.6.4
Debian1 product
- python-authlib< 1.2.0-1+deb12u1 | < 1.6.0-1+deb13u1 | < 1.6.4-1
PyPI1 product
- authlib< 1.6.4
Ubuntu1 product
- python-authlib< 0.15.5-1ubuntu0.1~esm1 | < 1.3.0-1ubuntu0.1~esm1 | All versions (No fix recorded)
6 vendors · 14 products
References
12 links- github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32X Refsource CONFIRMWEBREPORTAdvisoryExploitVendor Advisory
- github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479dfX Refsource MISCWEBREPORTFIXPatch
- github.com/authlib/authlibPACKAGE
- pypi.org/project/authlibPACKAGE