authlib@0.15.3 vulnerabilities

The ultimate Python library in building OAuth and OpenID Connect servers and clients.

Known vulnerabilities in the authlib package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature which allow HMAC verification with ANY asymmetric public key. If the' algorithm' field is left unspecified, an attacker can manipulate the verification process by exploiting the flexibility in algorithm selection during the `jwt.decode` call. How to fix Improper Verification of Cryptographic Signature? Upgrade `authlib` to version 1.3.1 or higher.	[,1.3.1)
M Insecure Defaults authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Insecure Defaults in its JOSE implementation, which can be invoked without JWS algorithms. How to fix Insecure Defaults? Upgrade `authlib` to version 1.1.0 or higher.	[,1.1.0)
M Authentication Bypass authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Authentication Bypass in `rfc7515/jws.py` and `rfc7515/jwe.py`, which can succeed without a JWS key provided. How to fix Authentication Bypass? Upgrade `authlib` to version 1.1.0 or higher.	[,1.1.0)