PT-2025-38752 · Oauthlib+3 · Oauthlib+3

Al-Cybision · Published 2025-09-22 · Updated 2026-03-29 · CVE-2025-59420

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.4

Description Authlib’s JWS verification improperly handles tokens declaring unknown critical header parameters (crit), violating RFC 7515 specifications. An attacker can create a signed token with a critical header (for example, bork or cnf) that strict verifiers would reject, but Authlib accepts. This can lead to split-brain verification, policy bypass, replay attacks, or privilege escalation in environments with mixed-language fleets. The issue occurs because Authlib does not enforce the “must-understand” semantics defined for the crit parameter in RFC 7515. The deserialize compact() API endpoint is affected. The crit parameter is a list of critical header parameters that a recipient must understand and enforce. When a token includes a crit parameter with an unknown name, strict verifiers reject the token, while Authlib accepts it. This discrepancy can be exploited in heterogeneous environments where some components are strict and others are lenient.

Recommendations Update Authlib to version 1.6.4 or later.

Exploit

Fix

LPE

Insufficient Verification of Data Authenticity

Incorrect Authorization

Weakness Enumeration

CWE-345

CWE-863

Related Identifiers

CVE-2025-59420

DLA-4352-1

GHSA-9GGR-2464-2J32

USN-8065-1

Affected Products

Oauthlib

Debian

Linuxmint

Ubuntu

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59420.json · Exploit
• https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32 · Vendor Advisory
• https://github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479df · Patch
• https://ubuntu.com/security/notices/USN-8065-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59420 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62706 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8065-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59420 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4352-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-59420 · Security Note
• https://ubuntu.com/security/CVE-2024-37568 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9ggr-2464-2j32 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61920 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-59420 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68158 · Vendor Advisory