Incorrect authorization in authlib - #VU155714
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote user to obtain access tokens with scopes not authorized for the requesting client.
The vulnerability exists due to incorrect authorization in OpenIDImplicitGrant.create_granted_params when passing the raw requested scope to the token generator instead of the filtered allowed scope. A remote user can include disallowed scopes in an authorization request to obtain access tokens with scopes not authorized for the requesting client.
This issue requires a custom token generator that does not filter scopes. The authorization server must register OpenIDImplicitGrant or a subclass, the registered client must be permitted an implicit identity-token response type, and a user must log in and approve the request.