Build software better, together
{{ message }}
| Version | Supported |
|---|---|
| 1.1.x | ✅ |
| 0.15.x | ✅ |
| < 0.15 | ❌ |
If you found security bugs, please do not send a public issue or patch. You can send me email at me@lepture.com.
Or, you can use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.
GHSA-fg6f-75jq-6523 published Jan 8, 2026 by lepture
Moderate
Setting `alg: none` and a blank signature appears to bypass signature verification
GHSA-7wc2-qxgw-g8gg published Mar 4, 2026 by lepture
High
Authlib : JWE zip=DEF decompression bomb enables DoS
GHSA-g7f3-828f-7h7m published Oct 10, 2025 by lepture
Moderate
Authlib: Denial of Service via Oversized JOSE Segments
GHSA-pq5p-34cr-23v9 published Oct 10, 2025 by lepture
High
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
GHSA-9ggr-2464-2j32 published Sep 20, 2025 by lepture
High
Learn more about advisories related to authlib/authlib in the GitHub Advisory Database