CVE-2024-37568

Name of the Vulnerable Software and Affected Versions lepture Authlib versions prior to 1.3.1

Description The issue concerns algorithm confusion with asymmetric public keys in lepture Authlib. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider specifying an algorithm in jwt.decode calls to prevent HMAC verification with arbitrary asymmetric public keys.