{"id":86999,"date":"2026-04-26T16:10:10","date_gmt":"2026-04-26T16:10:10","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-59420-critical-vulnerability-in-authlib-python-library-s-jws-verification-process","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-59420-critical-vulnerability-in-authlib-python-library-s-jws-verification-process\/","title":{"rendered":"CVE-2025-59420: Critical Vulnerability in Authlib Python Library’s JWS Verification Process<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2025-59420 is a critical vulnerability identified in the Authlib Python library. This vulnerability, which affects versions of Authlib prior to 1.6.4, has potential system compromise or data leakage implications for any servers built using this library. The vulnerability’s importance is underscored by its high CVSS severity score of 7.5 and the risks it poses to OAuth and OpenID Connect servers.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-59420
\nSeverity: High – CVSS Score 7.5
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Authlib Python Library | Prior to version 1.6.4<\/p>\n

How the Exploit Works<\/strong><\/p>\n

This exploitable vulnerability lies in Authlib’s JWS verification process. It accepts tokens that declare unknown critical header parameters (crit). This behavior violates RFC 7515’s “must-understand” semantics. Attackers can craft a signed token with a critical header that strict verifiers would reject but Authlib would accept. In mixed-language fleets, this can enable split-brain verification, leading to policy bypass, replay attacks, or privilege escalation.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following pseudocode exemplifies the crafting of the malicious token:<\/p>\n

import jwt\nheader = {\n\"alg\": \"HS256\",\n\"typ\": \"JWT\",\n\"crit\": [\"bork\", \"cnf\"]\n}\npayload = {\"admin\": True}\nmalicious_token = jwt.encode(header, payload, \"secret_key\")<\/code><\/pre>\n
In this example, the `”crit”` field in the header contains unrecognized parameters (`”bork”` and `”cnf”`). This token will be rejected by strict verifiers but accepted by Authlib prior to version 1.6.4, potentially leading to policy bypass, replay attacks, or privilege escalation.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview CVE-2025-59420 is a critical vulnerability identified in the Authlib Python library. This vulnerability, which affects versions of Authlib prior to 1.6.4, has potential system compromise or data leakage implications for any servers built using this library. The vulnerability’s importance is underscored by its high CVSS severity score of 7.5 and the risks it poses […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86999","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t