authx (>=0.2.0, <=0.9.1), cumulusci (>=3.48.0, <=3.55.0.dev1) +4 more potentially affected by CVE-2026-41479 via authlib (0.15.5)

authlib PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authx =0.2.0, =3.48.0, =0.19.0, =1.0.1, =3.3.2 Source cves: CVE-2026-41479 Source advisory: OSV:PYSEC-2026-2119...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2026-41479 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2026-41479 Source advisory: OSV:PYSEC-2026-2119...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +188 more potentially affected by CVE-2026-41479 via authlib (>=1.0.0b2, <=1.6.9)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =2.5.0 and more Source cves: CVE-2026-41479 Source advisory: OSV:PYSEC-2026-2119...

authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2026-41479 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

CVE-2026-41479

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

CVE-2026-41479 Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

EUVD-2026-38360

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

CVE-2026-41479

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

CVE-2026-41479 Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (>=1.0.0, <=1.0.3) +252 more potentially affected by CVE-2026-41479 via authlib (>=0.10.0, <=1.6.9)

authlib PYPI version =0.10.0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.4.0rc1, =0.1.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.2.0, =2.0.1 and more Source cves: CVE-2026-41479 Source advisory: MEND:CVE-2026-41479...

agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-41479 via authlib (1.7.0)

authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-41479 Source advisory: MEND:CVE-2026-41479...

CVE-2026-41479 Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

CVE-2026-41479

Authlib’s OAuth 2.0 authorization endpoint is vulnerable to an unauthenticated open redirect when an unsupported response_type is requested and a attacker-controlled redirect_uri is supplied. This occurs before client lookup and any redirect_uri validation, allowing a single request to yield a 30...

CVE-2026-41479

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

asgi-request-duration (>=0.1.0, <=0.1.1), starlette-authlib (>=0.3.5, <=0.3.6) potentially affected by CVE-2026-54282 via starlette (0.42.0)

starlette PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =0.1.0, =0.3.5, =0.3.6 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

esmerald (1.2.3), htagweb (>=0.10.0, <=0.42.3) +3 more potentially affected by CVE-2026-54282 via starlette (0.29.0)

starlette PYPI version 0.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 1.2.3 - htagweb =0.10.0, =1.0.0, =1.0.1 - starlette-authlib 0.1.27 - starlette-bridge 0.2.0 Source cves: CVE-2026-54282 Source...

exchange-radar (1.0.0), lila-framework (>=0.2.0, <=0.2.5) +3 more potentially affected by CVE-2026-54282 via starlette (0.30.0)

starlette PYPI version 0.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - exchange-radar 1.0.0 - lila-framework =0.2.0, =0.1.88, =0.2.1a0, =0.2.2a0 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

dashai (>=0.1.0, <=0.1.2), openracer (0.6.6) +2 more potentially affected by CVE-2026-54282 via starlette (0.44.0)

starlette PYPI version 0.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - dashai =0.1.0, =0.1.2 - openracer 0.6.6 - pilot-platform-common 0.8.0 - starlette-authlib 0.3.7 Source cves: CVE-2026-54282 Source advisory:...

CVE-2026-41479: URL Redirection to Untrusted Site

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported responsetype and supplies an attacker-controlled redirecturi. The...

halfapi (>=0.6.29, <=0.6.31), starlette-authlib (0.1.32) +1 more potentially affected by CVE-2026-48817 via starlette (0.33.0)

starlette PYPI version 0.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - halfapi =0.6.29, =0.0.5, =0.0.6 Source cves: CVE-2026-48817 Source advisory: OSV:PYSEC-2026-2280...