PT-2025-41596 · Pypi+4 · Oauthlib+4

Al-Cybision · Published 2025-10-02 · Updated 2026-03-29 · CVE-2025-61920

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.5

Description Authlib, a Python library for building OAuth and OpenID Connect servers, has an issue in its JOSE implementation. It accepts JWS/JWT header and signature segments without size limits. An attacker can create a token with a very large base64url-encoded header or signature, potentially consuming excessive CPU and memory resources, leading to a denial of service. The library decodes and parses the entire input before rejecting it.

Recommendations Update to Authlib version 1.6.5 or later. Enforce input size limits before passing tokens to Authlib. Implement application-level throttling to reduce amplification risk.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

RCE

Weakness Enumeration

CWE-770

CWE-400

CWE-20

Related Identifiers

BDU:2026-03457

CVE-2025-61920

DLA-4352-1

GHSA-PQ5P-34CR-23V9

OPENSUSE-SU-2025:15629-1

SUSE-SU-2025:3754-1

USN-8065-1

Affected Products

Oauthlib

Debian

Linuxmint

Red Os

Ubuntu

References · 36

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61920.json · Exploit
• https://github.com/authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e · Patch
• https://github.com/authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4352-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15629-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-61920 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61920 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3754-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8065-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59420 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pq5p-34cr-23v9 · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61920 · Security Note
• https://ubuntu.com/security/CVE-2024-37568 · Vendor Advisory