Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-61920

25
FAUCET Score

CVE-2025-61920 is a denial-of-service vulnerability affecting Authlib, a Python library for OAuth and OpenID Connect servers, prior to version 1.6.5. It allows a remote attacker to craft oversized JWS/JWT tokens, causing excessive CPU and memory consumption during verification. The vulnerability has a CVSS score of 7.5 (HIGH) due to its network attack vector, low attack complexity, and high impact on availability. There is currently no evidence of active exploitation, and no public exploit code is available, with minimal community discussion and media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.6.5CPE matchmatch criteria
cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.60%
Probability of exploitation in next 30 days
EPSS Percentile
44.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0060 is in the 22nd percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

github_advisorypatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: authlibFixed in: 1.6.5
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.1Fixed in: quay/quay-rhel8:sha256:fe48d48bb338329da213a0a21d2ac706b4b731593f154d554bfd420ad21a2912
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.1Fixed in: quay/quay-rhel8:sha256:d0ad53575ddce599c11e959d3590300ab325633951003db4ef2d82a133c8ef19
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.12Fixed in: quay/quay-rhel8:sha256:38f094f62eed92d88eae0e7a9be410ef908bd0194b30240d49087ae76250e0ee
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.13Fixed in: quay/quay-rhel8:sha256:3d24fd39236e7f3180ff2cbef7a28e2e30d9609f6ec0538a41ad4a602eabd12e
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.9Fixed in: quay/quay-rhel8:sha256:c7c6fe7ff2592c0fdf51d6e3b0ce657dffcd131c60c00ce680acd89c5c286cee
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.9Fixed in: quay/quay-rhel8:sha256:2336ad8d4b4874a92c6cfcbc8458b6d26f7f6dde300ca0e159f2b73d7e6839cd
View patch

Vendor Advisories (2)

pipGHSA-pq5p-34cr-23v9high

Authlib is vulnerable to Denial of Service via Oversized JOSE Segments

Oct 10, 2025
redhatCVE-2025-61920Important

authlib: Authlib Denial of Service

Oct 10, 2025

References

lists.debian.org / debian-lts-announce/2025/10/msg00032.html
github.com / authlib/authlib/commit/867e3f87b072347a1ae9cf6983cc8bbf88447e5e
Patch
github.com / authlib/authlib/security/advisories/GHSA-pq5p-34cr-23v9
ExploitMitigationVendor Advisory