SB2026060843 - Open redirect in authlib

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026060843

SB2026060843 - Open redirect in authlib

Published: June 8, 2026

Security Bulletin ID SB2026060843
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Open redirect (CVE-ID: CVE-2026-41479)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to redirect users to an attacker-controlled URL.

The vulnerability exists due to url redirection to untrusted site in the OAuth 2.0 authorization endpoint when handling an authorization request with an unsupported response_type and a supplied redirect_uri. A remote attacker can send a specially crafted authorization request to redirect users to an attacker-controlled URL.

The redirect occurs before client lookup and before any redirect URI validation, and no valid client registration or authenticated user is required.


Remediation

Install update from vendor's website.

References