PyPI: datasette-indieauth

SFTY-20210414-30169

Safety legacy ID: pyup.io-39164

Datasette-indieauth before 1.1 trusts the "me" field returned by the authorization server without verifying it. https://github.com/simonw/datasette-indieauth/security/advisories/GHSA-mjcr-rqjg-rhg3

PyPI

Created at: Jul 14, 2026Updated at: Jul 14, 2026

Overview

Datasette-indieauth before 1.1 trusts the "me" field returned by the authorization server without verifying it. https://github.com/simonw/datasette-indieauth/security/advisories/GHSA-mjcr-rqjg-rhg3

Advisory

Datasette-indieauth before 1.1 trusts the "me" field returned by the authorization server without verifying it. https://github.com/simonw/datasette-indieauth/security/advisories/GHSA-mjcr-rqjg-rhg3

Affected Package

Affecting datasette-indieauth package, versions<1.1

Also affects

---

How to Fix

Upgradedatasette-indieauthto1.1or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

https://getsafety.com/vulnerabilities/SFTY-20210414-30169

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more