Server-Side Request Forgery (SSRF) in authlib - CVE-2026-114620
Published: October 14, 2026 / Updated: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to missing validation of the request_uri parameter in Authlib's RFC 9101 authorization request extension when processing authorization requests before authentication. A remote attacker can submit an authorization request containing an arbitrary request_uri to perform server-side request forgery against internal services, cloud metadata endpoints, and side-effectful GET routes.
Exploitation requires a valid, public client_id and an integrator-provided get_request_object() hook that fetches URLs without restrictions, as shown in the documented implementation. Response bodies are not reflected; distinguishable fetch errors and response timing provide a blind oracle for internal host and port discovery.