Critical Vulnerability Information Vulnerability Overview Vulnerability Name: Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) CVE ID: CVE-2025-5942 Severity: 7.5/10 (High) Affected Components and Versions Library: Authlib (JWS verification) API: Affected Versions: 1.6.3 Fixed Version: 1.6.4 Vulnerability Details Description: Authlib’s JWS verification accepts tokens that declare unknown critical headers ( ), violating RFC 7515’s “must understand” semantics. Attackers can craft signed tokens with critical headers (e.g., or ) that are rejected by strict validators but accepted by Authlib. In heterogeneous fleets, this leads to split-brain validation and may enable policy bypass, replay attacks, or privilege escalation. Observed Behavior: In Authlib 1.6.3, when a malformed JWS contains a protected header with and a object, or with an unknown parameter, Authlib verifies the signature and returns the payload without rejecting the token or enforcing security semantics. Impact Impact Across Heterogeneous Fleets: A strict ingress gateway (e.g., Nimbus/Vault) may reject a token, while a lenient Python microservice (e.g., Authlib) accepts the same token. This split-brain acceptance behavior circumvents intended security policies and may enable replay attacks or privilege escalation if carries binding or policy information. Remediation Recommendations Recommended Fixes: - Enforce during validation: reject any token that lists critical parameters not explicitly understood and enforced. - Implement a whitelist mechanism to recognize known critical parameters and validate their semantics (e.g., enforce binding when it exists and is listed in ).