aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (>=1.0.0, <=1.0.3) +256 more potentially affected by CVE-2026-44681 via authlib (>=0.10.0, <=1.6.11)

authlib PYPI version =0.10.0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.4.0rc1, =0.1.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.2.0, =2.0.1 and more Source cves: CVE-2026-44681 Source advisory: MEND:CVE-2026-44681...

CVE-2026-44681 Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

CVE-2026-44681

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

CVE-2026-44681 Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

CVE-2026-44681

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-44681 via authlib (1.7.0)

authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-44681 Source advisory: MEND:CVE-2026-44681...

CVE-2026-44681: URL Redirection to Untrusted Site

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an...

JOSE Authlib Information Disclosure

The vulnerability of the JOSE library Authlib implementation for OAuth and OpenID Connect servers is related to the disclosure of information due to incompatibility. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

exchange-radar (1.0.0), lila-framework (>=0.2.0, <=0.2.5) +3 more potentially affected by CVE-2026-48710 via starlette (0.30.0)

starlette PYPI version 0.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - exchange-radar 1.0.0 - lila-framework =0.2.0, =0.1.88, =0.2.1a0, =0.2.2a0 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

halfapi (>=0.6.29, <=0.6.31), starlette-authlib (0.1.32) +1 more potentially affected by CVE-2026-48710 via starlette (0.33.0)

starlette PYPI version 0.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - halfapi =0.6.29, =0.0.5, =0.0.6 Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

esmerald (1.2.3), htagweb (>=0.10.0, <=0.42.3) +3 more potentially affected by CVE-2026-48710 via starlette (0.29.0)

starlette PYPI version 0.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 1.2.3 - htagweb =0.10.0, =1.0.0, =1.0.1 - starlette-authlib 0.1.27 - starlette-bridge 0.2.0 Source cves: CVE-2026-48710 Source...

PT-2026-45185

Root has patched GHSA-jj8c-mmj3-mmgv in the rootio-Authlib package for Root:PyPI. Multiple fixed versions available...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-41425 DESCRIPTION: Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in...

Incorrect Authorization

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Incorrect Authorization via the validateauthorizationrequest function. An attacker can cause the server to redirect users to arbitrary URLs by submitting a crafted...

molten-jwt (0.3.0) potentially affected by CVE-2026-44681 via authlib (0.12.1)

authlib PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - molten-jwt 0.3.0 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

lumapps-sdk (>=1.0.0b13, <=1.0.0b18) potentially affected by CVE-2026-44681 via authlib (0.14.1)

authlib PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - lumapps-sdk =1.0.0b13, =1.0.0b18 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

authutils (5.0.3) potentially affected by CVE-2026-44681 via authlib (0.14.2)

authlib PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils 5.0.3 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2026-44681 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-44681 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-44681...

authx (>=0.2.0, <=0.9.1), cumulusci (>=3.48.0, <=3.55.0.dev1) +4 more potentially affected by CVE-2026-44681 via authlib (0.15.5)

authlib PYPI version 0.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authx =0.2.0, =3.48.0, =0.19.0, =1.0.1, =3.3.2 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...