PT-2024-27665 · Unknown+4 · Lepture Authlib+4

Emmharnuherl · Published 2024-06-09 · Updated 2026-03-29 · CVE-2024-37568

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions lepture Authlib versions prior to 1.3.1

Description The issue concerns algorithm confusion with asymmetric public keys in lepture Authlib. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider specifying an algorithm in jwt.decode calls to prevent HMAC verification with arbitrary asymmetric public keys.

Exploit

Fix

Improper Verification of Cryptographic Signature

Improper Access Control

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-347

CWE-284

CWE-327

Related Identifiers

CVE-2024-37568

DLA-4352-1

GHSA-5357-C2JX-V7QH

MGASA-2024-0238

OPENSUSE-SU-2024:14035-1

OPENSUSE-SU-2024_2064-1

PYSEC-2024-52

SUSE-SU-2024:2064-1

USN-8065-1

Affected Products

Debian

Linuxmint

Suse

Ubuntu

Lepture Authlib

References · 40

• 🔥 https://github.com/lepture/authlib/issues/654 · Exploit
• https://osv.dev/vulnerability/PYSEC-2024-52 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14035-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8065-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-37568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-37568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61920 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHJI32SN4FNAUVNALVGOKWHNSQ6XS3M5 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4352-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-37568 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:2064-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU · Vendor Advisory
• https://advisories.mageia.org/MGASA-2024-0238.html · Security Note
• https://ubuntu.com/security/CVE-2025-68158 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2024-37568 · Vendor Advisory