PT-2025-54492 · Pypi+3 · Oauthlib+3

Published 2025-01-01 · Updated 2026-03-05 · CVE-2025-68158

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Authlib versions 1.6.5 and prior

Description Authlib is a Python library used for building OAuth and OpenID Connect servers. A flaw exists in cache-backed state/request-token storage where it is not linked to the user session. This allows for Cross-Site Request Forgery (CSRF) if an attacker obtains a valid state, which is easily achievable through an attacker-initiated authentication flow. Specifically, the FrameworkIntegration.set state data function writes state data under the key state {app} {state}, while get state data disregards the caller’s session.

Recommendations Update Authlib to version 1.6.6 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-68158

GHSA-FG6F-75JQ-6523

OPENSUSE-SU-2026:10034-1

OPENSUSE-SU-2026:20257-1

SUSE-SU-2026:0828-1

USN-8065-1

Affected Products

Oauthlib

Debian

Linuxmint

Ubuntu

References · 29

• 🔥 https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68158.json · Exploit
• https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489 · Patch
• https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228 · Patch
• https://ubuntu.com/security/notices/USN-8065-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fg6f-75jq-6523 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62706 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10034-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68158 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-68158 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-68158 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-68158 · Security Note
• https://osv.dev/vulnerability/USN-8065-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59420 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-37568 · Vendor Advisory