Insufficient Verification of Data Authenticity in Authlib

Summary

Authlib is a Python library that builds OAuth and OpenID Connect servers. In versions prior to 1.6.4, Authlib's JWS verification accepts tokens that declare unknown critical header parameters ("crit"), violating RFC 7515 "must-understand" semantics. An attacker can craft a signed token with a critical header (for example, "bork" or "cnf") that strict verifiers reject, but Authlib accepts. In mixed-language fleets, this enables split-brain verification and can lead to policy bypass, replay attacks, or privilege escalation.