Vulnerabilities
Last updated 3 hours ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
oauthlib
|
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client | High Risk 8.0 | 7 hours ago | 7 hours ago |
|
authlib
|
Authlib RFC 7592 examples omit registration-access-token client binding | High Risk 8.8 | 7 hours ago | 7 hours ago |
|
authlib
|
Authlib: Default JWT bearer grant accepts assertions for the wrong audience | Medium Risk 6.8 | 3 days ago | 20 hours ago |
|
authlib
|
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys | High Risk 7.4 | 3 days ago | 20 hours ago |
|
authlib
|
Authlib: ID token can disable its own nonce validation via the nonce_supported claim | Medium Risk 4.2 | 3 days ago | 20 hours ago |
|
authlib
|
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF | Medium Risk 5.4 | 3 days ago | 20 hours ago |
|
authlib
|
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) | High Risk 7.4 | 3 days ago | 20 hours ago |
|
authlib
|
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts | Low Risk 2.6 | 3 days ago | 20 hours ago |
|
authlib
|
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens | Medium Risk 4.6 | 3 days ago | 20 hours ago |
|
authlib
|
No summary available | Low Risk 3.5 | 8 days ago | 20 hours ago |
|
authlib
|
No summary available | Critical 9.1 | 8 days ago | 20 hours ago |
|
authlib
|
No summary available | Critical 9.1 | 8 days ago | 20 hours ago |
|
authlib
|
No summary available | Medium Risk 4.2 | 8 days ago | 20 hours ago |
|
authlib
|
No summary available | Medium Risk 6.8 | 8 days ago | 20 hours ago |
|
authlib
|
No summary available | Medium Risk 4.6 | 8 days ago | 20 hours ago |
|
authlib
|
No summary available | Medium Risk 5.4 | 8 days ago | 20 hours ago |
|
authlib
|
Authlib JWS JWK Header Injection: Signature Verification Bypass | Critical 9.1 | 7 months ago | 3 days ago |
|
authlib
|
Authlib: empty signatures validation in JWS JSON deserialization | Critical 9.1 | 3 days ago | 3 days ago |
|
oauthlib
|
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow | High Risk 8.5 | 3 days ago | 3 days ago |
|
oauthlib
|
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation | Medium Risk 6.1 | 1 month ago | 17 days ago |
|
oauthlib
|
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208) | Medium Risk 6.8 | 1 month ago | 17 days ago |
|
oauthlib
|
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208) | Medium Risk 6.8 | 29 days ago | 29 days ago |
|
oauthlib
|
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation | Medium Risk 6.1 | 29 days ago | 29 days ago |
|
authlib
|
Authlib: Cross-site request forging when using cache | Medium Risk 5.4 | 6 months ago | 1 month ago |
|
authlib
|
Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect | Medium Risk 6.1 | 5 months ago | 1 month ago |
|
authlib
|
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification | High Risk 8.0 | 8 months ago | 1 month ago |
|
authlib
|
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments | High Risk 7.5 | 1 year ago | 1 month ago |
|
authlib
|
Authlib : JWE zip=DEF decompression bomb enables DoS | Medium Risk 6.5 | 1 year ago | 1 month ago |
|
authlib
|
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) | High Risk 7.5 | 1 year ago | 1 month ago |
|
authlib
|
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type | Medium Risk 5.4 | 4 months ago | 3 months ago |
|
authlib
|
Authlib JWS JWK Header Injection: Signature Verification Bypass | Critical 9.1 | 4 months ago | 3 months ago |
|
authlib
|
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding | High Risk 8.0 | 7 months ago | 3 months ago |
|
authlib
|
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle | High Risk 8.0 | 7 months ago | 3 months ago |
|
authlib
|
No summary available | Critical 9.8 | 7 months ago | 3 months ago |
|
authlib
|
No summary available | Medium Risk 5.4 | 4 months ago | 3 months ago |
|
authlib
|
No summary available | Medium Risk 6.5 | 7 months ago | 3 months ago |
|
authlib
|
No summary available | High Risk 7.5 | 7 months ago | 3 months ago |
|
authlib
|
Authlib has 1-click Account Takeover vulnerability | Medium Risk 5.7 | 9 months ago | 3 months ago |
|
authlib
|
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) | High Risk 7.5 | 3 months ago | 3 months ago |
|
authlib
|
Authlib has 1-click Account Takeover vulnerability | Medium Risk 5.7 | 3 months ago | 3 months ago |
|
authlib
|
Authlib : JWE zip=DEF decompression bomb enables DoS | Medium Risk 6.5 | 3 months ago | 3 months ago |
|
authlib
|
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments | High Risk 7.5 | 3 months ago | 3 months ago |
|
authlib
|
No summary available | Unknown | 2 years ago | 4 months ago |
|
authlib
|
No summary available | Medium Risk 6.1 | 5 months ago | 4 months ago |
|
authlib
|
No summary available | Medium Risk 5.4 | 6 months ago | 5 months ago |
|
authlib
|
Authlib has algorithm confusion with asymmetric public keys | High Risk 7.4 | 2 years ago | 12 months ago |
|
cryptoauthlib
|
Buffer overflow in deprecated USB HALs and stack overflow in USB enumeration | Low Risk 3.0 | 6 years ago | 1 year ago |
|
oauthlib
|
OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI | Medium Risk 5.7 | 4 years ago | 2 years ago |
|
oauthlib
|
No summary available | Unknown | 4 years ago | 2 years ago |
Page 1