CVE-2025-59420

{
  "id": "CVE-2025-59420",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-22T18:15:46.910",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.4, Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation. This issue has been patched in version 1.6.4."
    },
    {
      "lang": "es",
      "value": "Authlib es una biblioteca de Python que construye servidores OAuth y OpenID Connect. Antes de la versión 1.6.4, la verificación JWS de Authlib acepta tokens que declaran parámetros de encabezado críticos (crit) desconocidos, violando la semántica de 'must-understand' de RFC 7515. Un atacante puede crear un token firmado con un encabezado crítico (por ejemplo, bork o cnf) que los verificadores estrictos rechazan pero Authlib acepta. En flotas de lenguaje mixto, esto permite la verificación de cerebro dividido y puede conducir a la omisión de políticas, la repetición o la escalada de privilegios. Este problema ha sido parcheado en la versión 1.6.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "authlib",
          "product": "authlib",
          "versions": [
            {
              "version": "< 1.6.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-22T18:04:06.580297Z",
          "id": "CVE-2025-59420",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.6.4",
              "matchCriteriaId": "02148BAC-81FF-495B-933A-98B636364E1E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/authlib/authlib/commit/6b1813e4392eb7c168c276099ff7783b176479df",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/authlib/authlib/security/advisories/GHSA-9ggr-2464-2j32",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}