CVE-2026-114617

A flaw was found in Authlib. When validating OpenID Connect OIDC identity tokens, the library improperly relies on a claim within the incoming token to decide whether to enforce nonce verification, which binds the token to an active session. A remote attacker with a captured, validly signed token...

CVE-2026-114619

A flaw was found in Authlib. This vulnerability allows an authenticated client to bypass authorization scope restrictions and obtain an unauthorized OpenID Connect OIDC identity token, leading to information disclosure. During an implicit grant authorization request, the application evaluates the...

CVE-2026-114618

A flaw was found in Authlib. In the default JSON Web Token JWT bearer grant implementation, audience claims are checked only for existence rather than validated against the target authorization server. A remote attacker holding a legitimate token issued for another service can present it to a...

Linux Distros Unpatched Vulnerability : CVE-2026-114617

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the...

Linux Distros Unpatched Vulnerability : CVE-2026-114615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte...

Linux Distros Unpatched Vulnerability : CVE-2026-114619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the...

Linux Distros Unpatched Vulnerability : CVE-2026-114614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefi...

Linux Distros Unpatched Vulnerability : CVE-2026-114618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty lis...

Linux Distros Unpatched Vulnerability : CVE-2026-114620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticate...

Linux Distros Unpatched Vulnerability : CVE-2026-114616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.importkey and HMAC signing and verification path...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +287 more potentially affected by CVE-2026-114614 via authlib (>=1.0.0b2, <=1.7.2)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-114614 Source advisory: SNYK:PYTHON-AUTHLIB-21460694...

Open Redirect

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Open Redirect via the issecuretransport function in authlib/common/security.py, which performs a case-folded string prefix check on the raw URI rather than parsing it. A...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +301 more potentially affected by CVE-2026-114616 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-114616 Source advisory: SNYK:PYTHON-AUTHLIB-21460695...

Improper Verification of Cryptographic Signature

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the checkkey method in authlib/jose/rfc7518/octkey.py, where an empty octet-sequence oct key is accepted without err...

agentstack-cli (>=0.4.0rc1, <=0.7.1), agience-origin (>=0.1.0, <=0.2.9) +257 more potentially affected by CVE-2026-114615 via authlib (>=1.3.1, <=1.8.0)

authlib PYPI version =1.3.1, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =0.16.0, =0.33.0, =0.1.0, =0.24.1 and more Source cves: CVE-2026-114615 Source advisory: SNYK:PYTHON-AUTHLIB-21460693...

Incomplete List of Disallowed Inputs

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via JWTBearerGrant.verifyclaims in authlib/oauth2/rfc7523/jwtbearer.py, where audience validation is skipped when getaudiences retur...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +301 more potentially affected by CVE-2026-114618 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-114618 Source advisory: SNYK:PYTHON-AUTHLIB-21460692...

Improper Validation of Integrity Check Value

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the verifyclaims method in JWTBearerGrant, when getaudiences returns an empty list. Prior to the fix, an unconfigured or...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +301 more potentially affected by CVE-2026-114619 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-114619 Source advisory: SNYK:PYTHON-AUTHLIB-21460691...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +301 more potentially affected by CVE-2026-114617 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-114617 Source advisory: SNYK:PYTHON-AUTHLIB-21460690...