authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2026-41479 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

lumapps-sdk (>=1.0.0b13, <=1.0.0b18) potentially affected by CVE-2026-41479 via authlib (0.14.1)

authlib PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - lumapps-sdk =1.0.0b13, =1.0.0b18 Source cves: CVE-2026-41479 Source advisory: OSV:GHSA-W8P2-R796-3VMQ...

CVE-2026-41479

creationtimestamp| type| source ---|---|--- 2026-06-08 07:25:27+00:00| published-proof-of-concept| https://github.com/authlib/authlib/security/advisories/GHSA-w8p2-r796-3vmq...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate with watsonx Assistant Cartridge version 5.3.3 Vulnerability Details CVEID:CVE-2026-28498 DESCRIPTION: Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level...

PT-2026-47598

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.10 Authlib versions prior to 1.7.1 Description Authlib's OAuth 2.0 authorization endpoint is susceptible to an unauthenticated open redirect. This occurs when a request utilizes an unsupported response type and...

PT-2026-47585

Summary Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response type and supplies an attacker-controlled redirect uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As...

CVE-2026-44681

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

asgi-request-duration (>=0.1.0, <=0.1.1), starlette-authlib (>=0.3.5, <=0.3.6) potentially affected by CVE-2026-48710 via starlette (0.42.0)

starlette PYPI version 0.42.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - asgi-request-duration =0.1.0, =0.3.5, =0.3.6 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

halfapi (>=0.6.29, <=0.6.31), starlette-authlib (0.1.32) +1 more potentially affected by CVE-2026-48710 via starlette (0.33.0)

starlette PYPI version 0.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - halfapi =0.6.29, =0.0.5, =0.0.6 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

esmerald (1.2.3), htagweb (>=0.10.0, <=0.42.3) +3 more potentially affected by CVE-2026-48710 via starlette (0.29.0)

starlette PYPI version 0.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 1.2.3 - htagweb =0.10.0, =1.0.0, =1.0.1 - starlette-authlib 0.1.27 - starlette-bridge 0.2.0 Source cves: CVE-2026-48710 Source...

exchange-radar (1.0.0), lila-framework (>=0.2.0, <=0.2.5) +3 more potentially affected by CVE-2026-48710 via starlette (0.30.0)

starlette PYPI version 0.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - exchange-radar 1.0.0 - lila-framework =0.2.0, =0.1.88, =0.2.1a0, =0.2.2a0 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5M...

ROOT-APP-PYPI-CVE-2025-59420 CVE-2025-59420 in rootio-Authlib - Patched by Root

Root has patched CVE-2025-59420 in the rootio-Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-37568 CVE-2024-37568 in rootio-Authlib - Patched by Root

Root has patched CVE-2024-37568 in the rootio-Authlib package for Root:PyPI. Multiple fixed versions available...

python311-Authlib-1.7.2-1.1 on GA media (moderate)

python311-Authlib-1.7.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10883-1 Rating: moderate Cross-References: CVE-2026-44681 CVSS scores: CVE-2026-44681 SUSE : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability ca...

Linux Distros Unpatched Vulnerability : CVE-2026-44681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's...

SUSE CVE-2026-44681

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

OPENSUSE-SU-2026:10883-1 python311-Authlib-1.7.2-1.1 on GA media

These are all security issues fixed in the python311-Authlib-1.7.2-1.1 package on the GA media of openSUSE Tumbleweed...

DEBIAN-CVE-2026-44681

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

PYSEC-2026-188

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

PYSEC-2026-188

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...