CVE-2025-59420 Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Attackers can bypass authentication or escalate privileges by crafting JWTs with unknown critical headers that Authlib incorrectly accepts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59420?
CVE-2025-59420 is a high-severity authentication bypass vulnerability in authlib, published on 22 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4.
Which versions are affected by CVE-2025-59420?
3 open source packages ship an affected version, including authlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | All versions | 1.6.4 |
authlib PyPI | All versions | 1.6.4 |
authlib PyPI | All versions | 1.6.4 |
Products include Authlib Authlib.
How do I fix CVE-2025-59420?
Upgrade authlib to 1.6.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-59420 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59420 exists.
Other vulnerabilities in authlib
- CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Sources
Also known as DEBIAN-CVE-2025-59420, ECHO-bedb-8942-b6fb, GHSA-9ggr-2464-2j32, PYSEC-2026-1200, ROOT-APP-PYPI-CVE-2025-59420, UBUNTU-CVE-2025-59420.