SB2026101809 - Multiple vulnerabilities in authlib

Description

This security bulletin contains information about 2 vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read, modify, or delete other clients' registration records, potentially intercept authorization codes or tokens through redirect URI changes, and cause a denial of service by deleting registrations.

The vulnerability exists due to authorization bypass through a user-controlled client_id in Authlib's RFC 7592 ClientConfigurationEndpoint when handling registration management requests using the documented authenticate_client and check_permission implementations. A remote user can present a valid registration_access_token issued to their own client and supply another client's client_id to access, modify, or delete that client's registration if the target passes the editable check, because these implementations do not verify that the token belongs to the target client.

2) Inadequate Encryption Strength (CVE-ID: N/A)

CWE-ID: CWE-326 - Inadequate Encryption Strength

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to forge JWS/JWT tokens with arbitrary claims and bypass authentication.

The vulnerability exists due to acceptance of zero-length HMAC keys in Authlib's OctKey and HMACAlgorithm components when verifying JWS/JWT signatures using HS256, HS384, or HS512. A remote attacker can submit tokens signed with an empty key, whose signatures are publicly reproducible, to bypass signature verification in applications whose verification key resolves to an empty value.

Remediation

Install update from vendor's website.

References

• https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v
• https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg