Reliance on Untrusted Inputs in a Security Decision in authlib - CVE-2026-114617
Published: October 14, 2026 / Updated: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and access a victim's account at the relying party.
The vulnerability exists due to reliance on untrusted inputs in a security decision in OpenIDMixin.parse_id_token() when validating an ID token containing a nonce_supported claim set to boolean false. A remote attacker can replay a captured victim's ID token into an attacker-controlled session despite a mismatched nonce to bypass authentication and access a victim's account at the relying party.
The token must have a valid signature and pass issuer and audience validation. Exploitation requires the ability to supply the token to parse_id_token(). Implicit and hybrid relying parties and applications directly processing externally supplied ID tokens are affected; plain authorization code flow is not affected. User interaction is required.