Skip to main content

Authlib CVE-2025-68158

HIGH
Cross-Site Request Forgery (CSRF) (CWE-352)
2026-01-08 security-advisories@github.com GHSA-fg6f-75jq-6523
Python CSRF Authlib
8.8
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-352
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 5.7 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required. Public exploit/POC available.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Authlib is a Python library which builds OAuth and OpenID Connect servers. [CVSS 5.7 MEDIUM]

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 1.6.6.. Restrict network access to the affected service where possible.

Affected Packages

pypi authlib fix: 1.6.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-352 (Cross-Site Request Forgery (CSRF)). Affects Authlib. Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller

Know when Authlib gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE 5.7 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Red Hat 5.7 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Severity Changed
Oct 14, 2026 - 17:22 NVD
MEDIUM HIGH
CVSS changed
Oct 14, 2026 - 17:22 NVD
5.7 (MEDIUM) 8.8 (HIGH)
PoC Detected
Mar 30, 2026 - 13:16 vuln.today
Public exploit code
Patch released
Mar 30, 2026 - 13:16 nvd
Patch available
CVE Published
Jan 08, 2026 - 18:15 nvd
MEDIUM 5.7

DescriptionNVD

Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.

Executive ViewAI

Why It Matters

Organizations using Authlib should be aware of moderate risk from CVE-2025-68158, a cross-site request forgery vulnerability rated CVSS 5.7. Users could be tricked into performing unintended actions. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: implement SameSite cookie attributes and anti-CSRF tokens.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Low

Priority Score

64
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Request Forgery MEDIUM

Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.

Affected Products (CPE)NVD

cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*

More in Authlib

View all
CVE-2026-28802 HIGH POC
7.7 Mar 06

Authentication bypass in Authlib (Python OAuth/OpenID Connect library) versions 1.6.5 through 1.6.6 allows remote attack
CVE-2025-59420 HIGH POC
7.5 Sep 22

Authlib is a Python library which builds OAuth and OpenID Connect servers. Rated high severity (CVSS 7.5), this vulnerab
CVE-2025-61920 HIGH POC
7.5 Oct 10

Authlib's JOSE/JWS verification path (through 1.6.4, with 1.6.5 as the fix) decodes attacker-supplied JWT/JWS header and
CVE-2024-37568 HIGH POC
7.5 Jun 09

lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Rated high severity (CVSS 7.5), this v
CVE-2026-119284 MEDIUM POC
6.9 Oct 29

Memory exhaustion in joserfc before 1.7.6 allows remote unauthenticated attackers to force a roughly token-sized extra a
CVE-2025-62706 MEDIUM POC
6.5 Oct 22

Unbounded DEFLATE decompression in Authlib's JWE zip=DEF handling (authlib/jose/rfc7518/jwe_zips.py) lets a small, valid
CVE-2026-96760 CRITICAL
9.8 Sep 28

Signature verification bypass in Authlib 1.7.2 and earlier allows unauthenticated remote attackers to have crafted JWS J
CVE-2026-104056 CRITICAL
9.8 Oct 01

Poisoned OAuth/OIDC discovery metadata in Authlib 1.7.2 and earlier allows an attacker who controls or intercepts the me
CVE-2026-114620 MEDIUM POC
5.4 Oct 22

Server-side request forgery in Authlib's RFC 9101 JWTAuthenticationRequest (JAR) extension lets unauthenticated remote a
CVE-2026-48990 MEDIUM POC
5.3 Jun 17

Resource exhaustion in joserfc (versions 1.3.4-1.6.5) is possible because the RFC7797 unencoded-payload (b64=false) JWS

CVE-2026-114616 CRITICAL
9.1 Oct 22

Token forgery in the Authlib Python library before 1.9.1 lets a remote, unauthenticated attacker mint HS256, HS384 or HS
CVE-2026-114615 CRITICAL
9.1 Oct 22

JWT signature-verification bypass in the Python Authlib library (1.3.1 through 1.8.0) lets a remote attacker who knows o

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2017-9757 HIGH POC
8.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Python 3 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
openSUSE Leap 15.6 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed

References

Advisories & patches
PATCH https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489 PATCH https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228 ADVISORY https://access.redhat.com/errata/RHSA-2026:6497 ADVISORY https://access.redhat.com/errata/RHSA-2026:6567 ADVISORY https://access.redhat.com/errata/RHSA-2026:6568 ADVISORY https://vuldb.com/vuln/340151 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0828/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy