Vulnerability Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Authlib | Authlib | < 1.6.5 |
Related Weaknesses (CWE)
References
- https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447ePatch
- https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9ExploitMitigationVendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html
FAQ
What is CVE-2025-61920?
CVE-2025-61920 is a vulnerability with a CVSS score of 7.5 (HIGH). Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attac...
How severe is CVE-2025-61920?
CVE-2025-61920 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-61920?
Check the references section above for vendor advisories and patch information. Affected products include: Authlib Authlib.