Algorithm Confusion Vulnerability in Authlib by Lepture

CVE-2024-37568

What is CVE-2024-37568?

The Authlib framework developed by Lepture has a vulnerability that stems from algorithm confusion, particularly concerning the handling of asymmetric public keys. Specifically, when the jwt.decode method is called without specifying an algorithm, it inadvertently permits HMAC verification with any provided asymmetric public key. This flaw closely mirrors issues identified in prior vulnerabilities such as CVE-2022-29217 and CVE-2024-33663, emphasizing a significant security risk that could be exploited if not addressed in future updates.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References