Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.
References
| Link | Resource |
|---|---|
| https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e | Patch |
| https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9 | Exploit Mitigation Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html |
Configurations
History
03 Nov 2025, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9 - Exploit, Mitigation, Vendor Advisory |
20 Oct 2025, 16:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e - Patch | |
| References | () https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9 - Exploit, Vendor Advisory, Mitigation | |
| CPE | cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:* | |
| First Time |
Authlib authlib
Authlib |
10 Oct 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-10 20:15
Updated : 2025-11-03 18:17
NVD link : CVE-2025-61920
Mitre link : CVE-2025-61920
CVE.ORG link : CVE-2025-61920
JSON object : View
Products Affected
authlib
- authlib