CVE-2025-61920: authlib Improper Input Validation
Vulnerability summary
CVE-2025-61920 is a high (CVSS 7.5) Improper Input Validation vulnerability in authlib. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 10-10-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
0.00 pp
From 0.64% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAuthlib
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard2 products
- mlflow< 3.4.0-r2
- mlflow-iamguarded-compat< 3.4.0-r2
Opensuse2 products
- python-Authlib&distro=openSUSE Leap 15.6< 1.3.1-150600.3.6.1
- python-Authlib&distro=openSUSE Tumbleweed< 1.6.5-1.1
Suse2 products
- python-Authlib&distro=SUSE Linux Enterprise Module for Python 3 15 SP6< 1.3.1-150600.3.6.1
- python-Authlib&distro=SUSE Linux Enterprise Module for Python 3 15 SP7< 1.3.1-150600.3.6.1
Wolfi2 products
- mlflow< 3.4.0-r2
- mlflow-iamguarded-compat< 3.4.0-r2
Authlib1 product
- authlib< 1.6.5
Debian1 product
- python-authlib< 1.2.0-1+deb12u1 | < 1.6.0-1+deb13u1 | < 1.6.5-1
PyPI1 product
- authlib< 1.6.5
Ubuntu1 product
- python-authlib< 0.15.5-1ubuntu0.1~esm1 | < 1.3.0-1ubuntu0.1~esm1 | All versions (No fix recorded)
8 vendors · 12 products
References
15 links- github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9X Refsource CONFIRMWEBREPORTAdvisoryExploitMitigationVendor Advisory
- github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5eX Refsource MISCWEBREPORTFIXPatch
- github.com/authlib/authlibPACKAGE
- pypi.org/project/authlibPACKAGE