PT-2025-41596 · Pypi +1 · Oauthlib +1

Al-Cybision · Published 2025-10-10 · Updated 2025-10-23 · CVE-2025-61920

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.5

Description Authlib, a Python library for building OAuth and OpenID Connect servers, has an issue in its JOSE implementation. It accepts JWS/JWT header and signature segments without size limits. An attacker can create a token with a very large base64url-encoded header or signature, potentially consuming excessive CPU and memory resources, leading to a denial of service. The library decodes and parses the entire input before rejecting it.

Recommendations Update to Authlib version 1.6.5 or later. Enforce input size limits before passing tokens to Authlib. Implement application-level throttling to reduce amplification risk.

Fix

DoS

Resource Exhaustion

RCE

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-20

CWE-770

Related Identifiers

CVE-2025-61920

GHSA-PQ5P-34CR-23V9

SUSE-SU-2025:3754-1

Affected Products

Oauthlib

Debian

References · 22

• https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9 · Vendor Advisory
• https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61920 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3754-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61920 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61920 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61920 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/python-authlib · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61920 · Security Note
• https://ubuntu.com/security/CVE-2025-61920 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pq5p-34cr-23v9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61920 · Vendor Advisory
• https://github.com/authlib/authlib · Note
• https://twitter.com/CVEnew/status/1976735427127111974 · Twitter Post