Incorrect authorization in authlib - CVE-2025-59420
Published: October 31, 2025
Vulnerability identifier: #VU117879
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-59420
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to Authlib's JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 "must‑understand" semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation.
Affected software
authlib
Quay
Ubuntu
python-authlib (Ubuntu package)
Quay
Ubuntu
python-authlib (Ubuntu package)
How to mitigate CVE-2025-59420
Install updates from vendor's website.
authlib - update to 1.6.4
Quay - addressed in versions 3.9.0, 3.12.0, 3.13.10
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm1, 1.3.0-1ubuntu0.1~esm1
Quay - addressed in versions 3.9.0, 3.12.0, 3.13.10
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm1, 1.3.0-1ubuntu0.1~esm1