PT-2026-121661

Name of the Vulnerable Software and Affected Versions Authlib versions 0.13 through 1.7.9 Description The is secure transport function in authlib/common/security.py uses a textual prefix comparison for loopback HTTP exemptions. This allows a URL with a userinfo component starting with a loopback...

PT-2026-121674

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description The OpenIDMixin.parse id token function in the authlib/integrations/base client/sync openid.py and authlib/integrations/base client/async openid.py files incorrectly processes the nonce supported cla...

Linux Distros Unpatched Vulnerability : CVE-2026-104056

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a...

SUSE CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

A flaw was found in Authlib. The OpenID Connect OIDC and OAuth discovery metadata is cached without validating that returned endpoint addresses match the origin of the configured issuer. A remote attacker who supplies a malicious discovery response can replace legitimate service endpoints with...

DEBIAN-CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

UBUNTU-CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

Authlib contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server...

CVE-2026-104056 CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

EUVD-2026-91003

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056 CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

CVE-2026-104056

The Authlib library (version 1.7.2 and below) contains a vulnerability where OpenID Connect (OIDC) and OAuth discovery metadata is cached without sufficient validation or issuer-origin binding . A remote attacker providing a malicious discovery response can replace legitimate service endpoints wi...

CVE-2026-104056

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

PT-2026-103966

🚨Critical - Authlib OpenID Discovery Cache Poisoning CVE-2026-104056 Authlib caches OIDC discovery JSON .well-known/openid-configuration without validating issuer/origin binding. By poisoning the cached discovery response, an attacker can swap authorization/token/jwks uri endpoints to...

CVE-2026-104056: Insufficient Verification of Data Authenticity

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of...

Linux Distros Unpatched Vulnerability : CVE-2026-96760

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS...

SUSE CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +301 more potentially affected by CVE-2026-96760 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-96760 Source advisory: SNYK:PYTHON-AUTHLIB-20257410...