CVE-2025-59420

Katalog CVE

CVSS 7.5 · High EPSS 0,26%

Kerentanan Insufficient Verification of Data Authenticity pada authlib. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.

Rincian

Terbit di NVD

22 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32 exploit · advisory vendor
• https://github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479df patch
• https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html