Open redirect in authlib - CVE-2026-41479
Published: June 8, 2026
Vulnerability identifier: #VU133912
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41479
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect users to an attacker-controlled URL.
The vulnerability exists due to url redirection to untrusted site in the OAuth 2.0 authorization endpoint when handling an authorization request with an unsupported response_type and a supplied redirect_uri. A remote attacker can send a specially crafted authorization request to redirect users to an attacker-controlled URL.
The redirect occurs before client lookup and before any redirect URI validation, and no valid client registration or authenticated user is required.
Affected software
authlib
How to mitigate CVE-2026-41479
Install security update from vendor's website.
authlib - addressed in versions 1.6.10, 1.7.1