Incorrect authorization in authlib - CVE-2026-114619
Published: October 14, 2026 / Updated: October 23, 2026
Vulnerability details
The vulnerability allows a remote user to bypass client scope restrictions and obtain signed identity tokens containing user identity claims.
The vulnerability exists due to incorrect authorization in authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validate_authorization_request when checking the raw requested scope instead of the client's allowed scope during authorization request validation. A remote user can submit an authorization request containing the disallowed openid scope to bypass client scope restrictions and obtain signed identity tokens containing user identity claims.
Exploitation requires a registered client permitted to use the id_token or id_token token response type, with allowed scopes that exclude openid but include a claim-bearing scope such as profile. The authorization server must register OpenIDImplicitGrant or a subclass, and a user must log in and approve the request. The issued identity token's audience is the requesting client.