Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0828-1 advisory.

    - CVE-2025-68158: Fixed 1-click account takeover in applications that use the Authlib library     (bsc#1256414)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8065-1 advisory.

    Millie Solem discovered that Authlib did not properly restrict algorithm selection during JWT     verification, allowing HMAC verification with asymmetric public keys when no algorithm was specified. A     remote attacker could possibly use this issue to bypass signature verification and forge tokens, resulting     in authentication bypass or privilege escalation. (CVE-2024-37568)

    Muhammad Noman Ilyas discovered that Authlib did not properly enforce critical header parameter handling     during JSON Web Signature verification, leading to unknown critical parameters being incorrectly accepted.
    A remote attacker could possibly use this issue to bypass security policies in mixed deployments,     resulting in authentication bypass, replay attacks, or privilege escalation. (CVE-2025-59420)

    Muhammad Noman Ilyas discovered that Authlib did not properly limit the size of JSON Web Signature or JSON     Web Token header and signature segments. A remote attacker could possibly use this issue to cause     excessive memory or processor consumption, leading to a denial of service. (CVE-2025-61920)

    Muhammad Noman Ilyas discovered that Authlib performed unbounded decompression when processing certain     compressed encrypted tokens. A remote attacker could possibly use this issue to send a specially crafted     token that can be expanded to a large size during decompression, causing a denial of service.
    (CVE-2025-62706)

    It was discovered that Authlib did not properly bind cached state information to the initiating user     session during OAuth authentication flows. A remote attacker could possibly use this issue to perform     cross- site request forgery attacks, resulting in unauthorized actions or authentication bypass. This     issue only affected Ubuntu 24.04 LTS. (CVE-2025-68158)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20257-1 advisory.

    Changes in python-Authlib:

    - CVE-2025-68158: Fixed 1-click account takeover in applications that use the Authlib library     (bsc#1256414)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior,     cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible     for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow).
    When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the     entire state blob under _state_{app}_{state}, and get_state_data ignores the caller's session altogether.
    This issue has been patched in version 1.6.6. (CVE-2025-68158)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
301298	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Authlib (SUSE-SU-2026:0828-1)	Nessus	SuSE Local Security Checks	high
300274	Ubuntu 22.04 LTS / 24.04 LTS : Authlib vulnerabilities (USN-8065-1)	Nessus	Ubuntu Local Security Checks	high
299735	openSUSE 16 Security Update : python-Authlib (openSUSE-SU-2026:20257-1)	Nessus	SuSE Local Security Checks	high
282484	Linux Distros Unpatched Vulnerability : CVE-2025-68158	Nessus	Misc.	high

Detections

Analytics

CVE-2025-68158

high

Tenable Plugins

high

high

high

high