Access Control

Every one of the 3 is a mark on the map. Named now: 1 to 3, most at risk first.

1. lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asym…CVE-2024-37568Authlib · CVSS 7.5 · 0.4% likely

   CWE-284

2. CVE-2026-104056Authlib · CVSS 9.8 · 0.2% likely

   CWE-346

3. Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensCVE-2026-114619authlib · CVSS 4.6 · 0.2% likely

   CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.