CVE-2025-61920

HIGH EPSS 43.4%
Published Oct 10, 20258mo ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Oct 10, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago

Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
43.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 3

CWE-20 Improper Input Validation Validation
CWE-400 Uncontrolled Resource Consumption Resource Mgmt
CWE-770

Affected Products 1

VendorProductVersionRange
authlibauthlib* <1.6.5

References 3

  • github.com https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e
    Patch
  • github.com https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9
    ExploitMitigationVendor Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html

Remediation

  • github.com https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e
    Patch