A
Vendor security profile
authlib
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs6
Critical3
CISA KEV0
Public exploit5
Patch rate%50
Avg. CVSS8.5
12-month vulnerability rate
0
0
0
0
3
0
0
0
0
1
1
1
CVE KEV
CVE severity distribution
6toplam CVE
Critical3 (50%)
High2 (33%)
Medium1 (17%)
Patch and exploitation view
%50
Verified patch
%0
CISA KEV
%83
Public exploit
3Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
9.8
CVE-2026-104056
CVE-2026-104056
A
Patch status unknownEPSS %0
9.8
CVE-2026-96760
Authlib library contains a signature‑verification bypass vulnerability
A
Patch status unknownEPSS %0
6.5
CVE-2026-75509
joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)
A
Patch status unknownEPSS %0
8.2
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
A
Patch verifiedEPSS %0
9.1
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
A
Patch verifiedEPSS %1
7.7
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
A
Patch verifiedEPSS %1