Authorization bypass through user-controlled key in authlib - #VU156091
Published: October 18, 2026
Vulnerability details
The vulnerability allows a remote user to read, modify, or delete other clients' registration records, potentially intercept authorization codes or tokens through redirect URI changes, and cause a denial of service by deleting registrations.
The vulnerability exists due to authorization bypass through a user-controlled client_id in Authlib's RFC 7592 ClientConfigurationEndpoint when handling registration management requests using the documented authenticate_client and check_permission implementations. A remote user can present a valid registration_access_token issued to their own client and supply another client's client_id to access, modify, or delete that client's registration if the target passes the editable check, because these implementations do not verify that the token belongs to the target client.