{"action":"Upgrade authlib to 1.3.1 or later.","affected":[{"fixed":"1.3.1","introduced":"0"}],"component":"authlib","cve_ids":["CVE-2024-37568"],"ecosystem":"PyPI","epss":0.00388,"exploited":false,"fixed_versions":["1.3.1"],"ghsa_id":"GHSA-5357-c2jx-v7qh","id":"tcs_01M5KGN9J889B18BMNX6DZK3KH","modified_at":"2026-06-10T17:00:37.089999360Z","published_at":"2024-06-09T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-52","https://github.com/lepture/authlib/issues/654","https://github.com/advisories/GHSA-5357-c2jx-v7qh"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2024-52","url":"https://osv.dev/vulnerability/PYSEC-2024-52"}],"summary":"lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (T"}