joserfc is a Python library for JOSE standards. Before version 1.7.5, decrypt_json() processed every entry of a JWE General JSON recipients array without a count limit, performing one RSA private-key decryption per entry. An unauthenticated attacker who can submit JWE General JSON to an endpoint using an RSA key-management algorithm can choose the amount of CPU work per request and exhaust the service's CPU. The verify_all_recipients option does not limit this work, and there is no impact on confidentiality or integrity.
Authlib · joserfc
Authlib, a Python library for OAuth and OpenID Connect servers, does not bind the registration access token to the client it was issued for in the documented RFC 7592 reference implementations. A client holding any valid registration access token can read, modify or delete the registration of another client. Changing redirect_uris can enable interception of authorization codes or tokens, and deleting registrations can cause denial of service. Exploitation requires that the application follows these reference implementations and allows a low-privileged client to obtain a registration access token.
Authlib · Authlib
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Authlib, a Python library for OAuth and OpenID Connect, accepts an empty HMAC key for HS256, HS384 and HS512 signatures. If an application loads its verification secret from a source that can return an empty value, an attacker can compute a valid signature for arbitrary token claims without knowing any secret. Authlib then treats the forged token as authentic, which can lead to authentication bypass, for example through elevated scopes or impersonation of other users.
Authlib · Authlib
Authlib, a Python library for OAuth and OpenID Connect, does not fully block the use of asymmetric public keys as HMAC secrets. If a deployment verifies tokens with a PEM or certificate key that starts with whitespace, a comment or a byte-order mark, and uses the module-level jwt object with its mixed algorithm list, an unauthenticated attacker who holds only that public key can forge HS256 tokens with arbitrary identity or authorization claims. This bypasses the fix for CVE-2024-37568.
Authlib · Authlib
Research and translation in progress – available shortly.
joserfc is a Python library implementing JOSE standards. Before version 1.7.4, the General JSON Serialization path of JWS deserialization treats a message with an empty signatures array as authenticated. An attacker without a signing key can therefore supply an arbitrary payload that the relying application may accept as genuine. The flaw does not affect compact JWS/JWT, Flattened JSON serialization or JWE JSON processing.
authlib · joserfc
Authlib 1.7.2 and earlier cache OpenID Connect discovery metadata without validating it or binding the returned endpoint URLs to the origin of the configured metadata URL. A poisoned or manipulated discovery response can therefore replace the token, userinfo, JWKS and logout endpoints with attacker-controlled URLs. Authlib then sends authorization codes, client secrets and bearer tokens to these endpoints without rejecting them. Exploitation requires the ability to tamper with the discovery response or cache, for example through a compromised CDN, upstream or network position.
Authlib · Authlib
