{"action":"Upgrade authlib to 1.3.1 or later.","affected":[{"fixed":"1.3.1","introduced":"0"}],"component":"authlib","cve_ids":["CVE-2024-37568"],"ecosystem":"PyPI","epss":0.00388,"exploited":false,"fixed_versions":["1.3.1"],"ghsa_id":"GHSA-5357-c2jx-v7qh","id":"tcs_01M5KEZN4T1C8RFRPW2RE4TSH0","modified_at":"2025-11-03T19:51:46.365561Z","published_at":"2024-06-09T21:30:33Z","references":["https://osv.dev/vulnerability/GHSA-5357-c2jx-v7qh","https://nvd.nist.gov/vuln/detail/CVE-2024-37568","https://github.com/lepture/authlib/issues/654","https://github.com/lepture/authlib","https://github.com/pypa/advisory-database/tree/main/vulns/authlib/PYSEC-2024-52.yaml","https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHJI32SN4FNAUVNALVGOKWHNSQ6XS3M5","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU","https://www.vicarius.io/vsociety/posts/algorithm-confusion-in-lepture-authlib-cve-2024-37568"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-5357-c2jx-v7qh","url":"https://osv.dev/vulnerability/GHSA-5357-c2jx-v7qh"}],"summary":"Authlib has algorithm confusion with asymmetric public keys"}