CVE-2024-37568: Authlib has algorithm confusion with asymmetric public keys
(updated )
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)
References
- github.com/advisories/GHSA-5357-c2jx-v7qh
- github.com/lepture/authlib
- github.com/lepture/authlib/issues/654
- github.com/pypa/advisory-database/tree/main/vulns/authlib/PYSEC-2024-52.yaml
- lists.debian.org/debian-lts-announce/2025/10/msg00032.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHJI32SN4FNAUVNALVGOKWHNSQ6XS3M5
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU
- nvd.nist.gov/vuln/detail/CVE-2024-37568
- www.vicarius.io/vsociety/posts/algorithm-confusion-in-lepture-authlib-cve-2024-37568
Code Behaviors & Features
Detect and mitigate CVE-2024-37568 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →