CVE-2025-59420

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

State: Published
Severity: 7.5 High
Published: Sep 22, 2025
Updated: Nov 3, 2025
Reserved: Sep 15, 2025

Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	GitHub_M

Weaknesses

CWE-345 Insufficient Verification of Data Authenticity
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
authlibauthlib	< 1.6.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.