CVE-2025-59420 - CVE House
Back to Database
Status published High CVE-2025-59420

Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)

Vulnerability Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59420

Credits & Attribution

No credits recorded in the NVD database.

References

More from authlib

View All →
CVE-2025-68158
Authlib: 1-click Account Takeover
Medium 5.7
CVE-2025-65015
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Critical 9.2
CVE-2025-62706
Authlib : JWE zip=DEF decompression bomb enables DoS
Medium 6.5
CVE-2025-61920
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
High 7.5

Affected Vendor

Affected Software

authlib
Vulnerable Versions:
< 1.6.4

Timeline

Official Publish: September 22nd, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-345 CWE-863

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1071 Application Layer Protocol
Command and Control
T1552 Unsecured Credentials
Credential Access
T1190 Exploit Public-Facing Application
Initial Access
T1041 Exfiltration Over C2 Channel
Exfiltration
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion