Cross-site request forgery in authlib - CVE-2026-41425
Published: April 16, 2026
Vulnerability identifier: #VU126313
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41425
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform cross-site request forgery and bind an attacker's account to a victim's session.
The vulnerability exists due to cross-site request forgery in OAuth integrations using the cache feature when handling OAuth callback requests with cached state. A remote attacker can send a crafted redirect URL to the victim to perform cross-site request forgery and bind an attacker's account to a victim's session.
User interaction is required for the victim to complete the authorization flow.
Affected software
authlib
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Python 3 Module
openSUSE Leap
Ubuntu
python-authlib (Ubuntu package)
python311-Authlib
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Python 3 Module
openSUSE Leap
Ubuntu
python-authlib (Ubuntu package)
python311-Authlib
How to mitigate CVE-2026-41425
Install security update from vendor's website.
authlib - update to 1.6.11
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm2, 1.3.0-1ubuntu0.1~esm2, 1.6.7-1ubuntu0.1~esm1
python311-Authlib - update to 1.3.1-150600.3.22.1
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm2, 1.3.0-1ubuntu0.1~esm2, 1.6.7-1ubuntu0.1~esm1
python311-Authlib - update to 1.3.1-150600.3.22.1