Overview
CVE-2025-59420 is a critical vulnerability identified in the Authlib Python library. This vulnerability, which affects versions of Authlib prior to 1.6.4, has potential system compromise or data leakage implications for any servers built using this library. The vulnerability’s importance is underscored by its high CVSS severity score of 7.5 and the risks it poses to OAuth and OpenID Connect servers.
Vulnerability Summary
CVE ID: CVE-2025-59420
Severity: High – CVSS Score 7.5
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Authlib Python Library | Prior to version 1.6.4
How the Exploit Works
This exploitable vulnerability lies in Authlib’s JWS verification process. It accepts tokens that declare unknown critical header parameters (crit). This behavior violates RFC 7515’s “must-understand” semantics. Attackers can craft a signed token with a critical header that strict verifiers would reject but Authlib would accept. In mixed-language fleets, this can enable split-brain verification, leading to policy bypass, replay attacks, or privilege escalation.
Conceptual Example Code
The following pseudocode exemplifies the crafting of the malicious token:
import jwt
header = {
"alg": "HS256",
"typ": "JWT",
"crit": ["bork", "cnf"]
}
payload = {"admin": True}
malicious_token = jwt.encode(header, payload, "secret_key")In this example, the `”crit”` field in the header contains unrecognized parameters (`”bork”` and `”cnf”`). This token will be rejected by strict verifiers but accepted by Authlib prior to version 1.6.4, potentially leading to policy bypass, replay attacks, or privilege escalation.