A symmetric cipher is configured in ECB mode.

Why this matters

ECB encrypts each block independently, so identical plaintext blocks yield identical ciphertext, leaking structure and enabling block-shuffling attacks (CWE-327). This matters for anything auth-related: encrypted tokens, cookies, credentials.

Use an authenticated mode: AES-GCM (AESGCM / modes.GCM) or, failing that, CBC with a random IV plus a separate MAC.

from Crypto.Cipher import AES

def encrypt(key, data):
    # ruleid: auth.py.crypto.ecb-mode
    cipher = AES.new(key, AES.MODE_ECB)
    return cipher.encrypt(data)

import os
from Crypto.Cipher import AES

def encrypt(key, data):
    nonce = os.urandom(12)
    # ok: authenticated GCM mode with a random nonce
    cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
    return cipher.encrypt(data)

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.crypto.ecb-mode -- <reason>

References