SB2026101462 - Multiple vulnerabilities in authlib

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101462

SB2026101462 - Multiple vulnerabilities in authlib

Published: October 14, 2026 Updated: October 23, 2026

Security Bulletin ID SB2026101462
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-114617)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and access a victim's account at the relying party.

The vulnerability exists due to reliance on untrusted inputs in a security decision in OpenIDMixin.parse_id_token() when validating an ID token containing a nonce_supported claim set to boolean false. A remote attacker can replay a captured victim's ID token into an attacker-controlled session despite a mismatched nonce to bypass authentication and access a victim's account at the relying party.

The token must have a valid signature and pass issuer and audience validation. Exploitation requires the ability to supply the token to parse_id_token(). Implicit and hybrid relying parties and applications directly processing externally supplied ID tokens are affected; plain authorization code flow is not affected. User interaction is required.


2) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-114615)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and disclose sensitive information.

The vulnerability exists due to incomplete rejection of asymmetric public keys in authlib.jose's OctKey.import_key() when importing PEM public keys or certificates with leading bytes before the armour header. A remote attacker can forge HS256 tokens with arbitrary claims using the issuer's public verification key as an HMAC secret to bypass authentication and disclose sensitive information.

Exploitation requires a relying party that uses the documented module-level jwt object with its mixed symmetric and asymmetric algorithm list. The leading bytes in the stored verification key are a deployment property and are not attacker-controlled at request time.


3) Incorrect authorization (CVE-ID: CVE-2026-114619)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass client scope restrictions and obtain signed identity tokens containing user identity claims.

The vulnerability exists due to incorrect authorization in authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validate_authorization_request when checking the raw requested scope instead of the client's allowed scope during authorization request validation. A remote user can submit an authorization request containing the disallowed openid scope to bypass client scope restrictions and obtain signed identity tokens containing user identity claims.

Exploitation requires a registered client permitted to use the id_token or id_token token response type, with allowed scopes that exclude openid but include a claim-bearing scope such as profile. The authorization server must register OpenIDImplicitGrant or a subclass, and a user must log in and approve the request. The issued identity token's audience is the requesting client.


4) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain access tokens with scopes not authorized for the requesting client.

The vulnerability exists due to incorrect authorization in OpenIDImplicitGrant.create_granted_params when passing the raw requested scope to the token generator instead of the filtered allowed scope. A remote user can include disallowed scopes in an authorization request to obtain access tokens with scopes not authorized for the requesting client.

This issue requires a custom token generator that does not filter scopes. The authorization server must register OpenIDImplicitGrant or a subclass, the registered client must be permitted an implicit identity-token response type, and a user must log in and approve the request.


5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-114620)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to missing validation of the request_uri parameter in Authlib's RFC 9101 authorization request extension when processing authorization requests before authentication. A remote attacker can submit an authorization request containing an arbitrary request_uri to perform server-side request forgery against internal services, cloud metadata endpoints, and side-effectful GET routes.

Exploitation requires a valid, public client_id and an integrator-provided get_request_object() hook that fetches URLs without restrictions, as shown in the documented implementation. Response bodies are not reflected; distinguishable fetch errors and response timing provide a blind oracle for internal host and port discovery.


6) Improper Authentication (CVE-ID: CVE-2026-114618)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain unauthorized access tokens.

The vulnerability exists due to improper authentication through missing audience validation in Authlib's default authlib.oauth2.rfc7523.JWTBearerGrant when validating JWT bearer assertions. A remote user can submit a legitimately issued JWT assertion intended for a different audience to the authorization server's token endpoint to obtain unauthorized access tokens.

Exploitation requires the issuing and accepting authorization servers to share the same signing key.


Remediation

Install update from vendor's website.

References