If you discover a security vulnerability, do not submit a public issue or patch. Instead, please report it privately through the GitHub Security tab.
Security: authlib/joserfc
Security
SECURITY.md
-
joserfc accepts JWT with padding, leading to JWT malleabilityGHSA-5jhw-7jv7-qcqq published
Jul 13, 2026 by leptureLow -
joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)GHSA-gg9x-qcx2-xmrh published
May 29, 2026 by leptureHigh -
RFC7797 b64=false JWS payloads bypass JWSRegistry payload-size limits during deserializationGHSA-wphv-vfrh-23q5 published
May 24, 2026 by leptureModerate -
PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)GHSA-w5r5-m38g-f9f9 published
Feb 28, 2026 by leptureHigh -
Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token PayloadsGHSA-frfh-8v73-gjg4 published
Nov 18, 2025 by leptureCritical
Learn more about advisories related to authlib/joserfc in the GitHub Advisory Database