aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +192 more potentially affected by CVE-2026-44681 via authlib (>=1.0.0b2, <=1.6.11)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =2.5.0 and more Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

cumulusci (>=3.32.0, <=3.37.0.dev0), lumapps-sdk (>=1.1.3b5, <=2.0.3) +3 more potentially affected by CVE-2026-44681 via authlib (0.15.3)

authlib PYPI version 0.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - cumulusci =3.32.0, =1.1.3b5, =0.1.0, =0.53.1, =0.1.0, =0.1.9 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

GHSA-R95X-QFJJ-FJJ2 Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

Summary An unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. Details...

agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-44681 via authlib (1.7.0)

authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-44681 Source advisory: SNYK:PYTHON-AUTHLIB-16643257...

agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-44681 via authlib (1.7.0)

authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-44681 Source advisory: GHSA-R95X-QFJJ-FJJ2...

meltano (>=1.60.0, <=2.1.0), molten-jwt (0.2.1) potentially affected by CVE-2026-44681 via authlib (0.10.0)

authlib PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - meltano =1.60.0, =2.1.0 - molten-jwt 0.2.1 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

agoras-platforms (>=2.0.0, <=2.0.1), apheris-auth (0.23.0) +2 more potentially affected by CVE-2026-44681 via authlib (1.7.0)

authlib PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - agoras-platforms =2.0.0, =0.51.0, =1.3.0b1, =1.3.0 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

authutils (>=6.1.2, <=6.2.2), dash-google-oauth (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2026-44681 via authlib (0.11.0)

authlib PYPI version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authutils =6.1.2, =1.0.0, =0.1.2, =0.2.0.dev5 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ2...

authlib-gino (>=0.1.0, <=0.3.0), cnmcclient (0.4.3) +14 more potentially affected by CVE-2026-44681 via authlib (0.14.3)

authlib PYPI version 0.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - authlib-gino =0.1.0, =0.1.2, =0.4.0, =0.1.2, =1.0.0b7, =0.2.0, =1.0.0, =7.0.8.dev28841, =3.5.6.dev19088, =5.1.1.dev24106 and more Source cves:...

Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect

Summary An unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. Details...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +192 more potentially affected by CVE-2026-44681 via authlib (>=1.0.0b2, <=1.6.11)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =1.7.0, =0.0.1, =0.1.0, =1.0.3, =2.0.0, =2.5.0 and more Source cves: CVE-2026-44681 Source advisory: SNYK:PYTHON-AUTHLIB-16643257...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-44681 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-44681...

bastion-key-client (>=1.0.1, <=1.4.0), fabric-am-handlers (>=0.11.0, <=1.4.0b2) +5 more potentially affected by CVE-2026-44681 via authlib (0.15.2)

authlib PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - bastion-key-client =1.0.1, =0.11.0, =0.14.0, =0.4.0, =0.9.0, =1.0.0b1, =1.0.0 Source cves: CVE-2026-44681 Source advisory: OSV:GHSA-R95X-QFJJ-FJJ...

[SECURITY] [DLA 4579-1] python-authlib security update

Debian LTS Advisory DLA-4579-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias May 11, 2026 https://wiki.debian.org/LTS Package : python-authlib Version : 0.15.4-1+deb11u2 CVE ID : CVE-2026-27962 CVE-2026-28490 CVE-2026-28498 Three security vulnerabilities were...

Debian dla-4579 : python-authlib-doc - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4579 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4579-1 [email protected]...

CVE-2026-41425

A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker could exploit a missing Cross-Site Request Forgery CSRF protection on the cache feature within authlib.integrations.starletteclient.OAuth. This vulnerability allows an attacker to trick ...

PT-2026-40589

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.12 Authlib versions prior to 1.7.1 Description An unauthenticated open redirect exists in the authorization endpoint of the OpenIDImplicitGrant and OpenIDHybridGrant components. A remote attacker can cause the...

SUSE CVE-2026-41425

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth. This vulnerability is fixed in 1.6.11...

Linux Distros Unpatched Vulnerability : CVE-2026-41425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in...

PYSEC-2026-25

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth. This vulnerability is fixed in 1.6.11...