Cross-site scripting in authlib - #VU159250
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in the authorization server's origin, access sensitive same-origin data, and perform authenticated actions on behalf of a victim.
The vulnerability exists due to insufficient redirect URI scheme validation in Authlib's OAuth/OIDC client-registration validators when processing redirect metadata for web clients, allowing cross-site scripting through response_mode=form_post. A remote user can register a client with a javascript: redirect URI and induce a victim to authorize it to execute JavaScript in the authorization server's origin. The resulting form action javascript://host/%0Adocument.body.innerHTML=location.origin demonstrates the exploit: Chromium decodes %0A into a line feed, treats //host/ as a comment, and executes the following JavaScript.
Exploitation requires the server to register OpenIDImplicitGrant.