Authorization bypass through user-controlled key in authlib - #VU163014

Vulnerability details

The vulnerability allows an administrator of a trusted tenant to obtain tokens for another organization's users and read or overwrite their data.

The vulnerability exists due to subject-only user resolution without issuer binding in Authlib's explicitly enabled ID-JAG grant when multiple identity providers are trusted. An administrator of a trusted tenant can submit assertions signed with their identity provider's key for a known victim subject, using genuine credentials for a client authorized for that victim, to impersonate the victim.

Affected software

Remediation

External References

• https://github.com/authlib/authlib/security/advisories/GHSA-9qr6-8289-9j56

Related Security Bulletins

• Authorization bypass through user-controlled key in authlib