CVE-2025-68158 Authlib: 1-click Account Takeover
Attackers can hijack user accounts via CSRF when cache-backed state storage is used, as state tokens are not tied to user sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-68158?
CVE-2025-68158 is a medium-severity vulnerability in authlib, published on 8 Jan 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.
Weakness: CWE-352
Which versions are affected by CVE-2025-68158?
3 open source packages ship an affected version, including authlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | From 1.0.0 | 1.6.6 |
authlib PyPI | From 1.0.0 | 1.6.6 |
authlib PyPI | From 1.0.0 | 1.6.6 |
Linux distribution packages (4)
python-Authlib SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 1.3.1-150600.3.14.1 |
python-Authlib openSUSE:Leap 15.6 | All versions | 1.3.1-150600.3.14.1 |
python-Authlib openSUSE:Leap 16.0 | All versions | 1.5.2-bp160.2.1 |
python-Authlib openSUSE:Tumbleweed | All versions | 1.6.6-1.1 |
Products include Authlib Authlib.
How do I fix CVE-2025-68158?
Upgrade authlib to 1.6.6 or later.
Is CVE-2025-68158 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68158 exists.
Other vulnerabilities in authlib
- CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Sources
Also known as DEBIAN-CVE-2025-68158, ECHO-9727-a15c-fedd, GHSA-fg6f-75jq-6523, MINI-2ww7-2mrm-vvq5, MINI-739w-f9m4-9ppc, PYSEC-2026-1201 and 4 more.