Denial of Service Vulnerability in Authlib Python Library from Authlib

CVE-2025-61920

What is CVE-2025-61920?

The Authlib Python library, widely used for building OAuth and OpenID Connect servers, contained a vulnerability in its JOSE implementation before version 1.6.5. This flaw allowed a remote attacker to create a malformed token with base64url-encoded header or signature segments that could be extremely large. During the verification process, Authlib would decode and attempt to parse this oversized input, which could significantly increase CPU and memory usage, potentially leading to a denial of service condition. Users are advised to upgrade to version 1.6.5 to mitigate this issue and to implement input size limits and application-level throttling as temporary workarounds.

References