A vulnerability in the Authlib library allows unauthenticated remote attackers to cause a denial of service by triggering excessive CPU and memory consumption via malformed tokens.

The vulnerability stems from improper input validation in the JOSE implementation, where the library fails to limit the size of JWS or JWT header and signature segments. An unauthenticated attacker can submit tokens containing massive base64url encoded segments, forcing the application to exhaust system resources during the parsing process.

The identified vulnerability carries a CVSS score of 7.5, indicating a high severity risk primarily due to the potential for service disruption. Successful exploitation allows an attacker to crash critical authentication services, resulting in significant system downtime and preventing legitimate users from accessing protected resources or applications.

Immediate Action: Upgrade the Authlib library to version 1.6.5 or later, which implements necessary input size limits to prevent resource exhaustion.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for unusual spikes that correlate with incoming authentication or authorization requests.

Compensating Controls: Implement strict input size validation at the web application firewall or load balancer level to reject tokens that exceed reasonable length requirements before they reach the Authlib library.

Public Exploit Available: Unknown

Given the potential for complete service denial, organizations relying on Authlib for OAuth or OpenID Connect functionality must prioritize this update. Administrators should verify their current library version and apply the 1.6.5 patch immediately to ensure the integrity and availability of their authentication infrastructure.