Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...

GHSA-C5MF-XMP2-59RC Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...

Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...

GHSA-Q686-2QMG-HQC7 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...

EUVD-2026-108521

Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens...

UBUNTU-CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

PT-2026-121757

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

Linux Distros Unpatched Vulnerability : CVE-2026-114619

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the...

DEBIAN-CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

CVE-2026-114617 Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid...

PT-2026-121674

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse id token reads the nonce supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybri...

PT-2026-121676

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate authorization request checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered clien...

CVE-2026-107371

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

RHLW-2026-2CEEE64F37112E19 Lightwell Security Advisory: cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002

Red Hat Lightwell has released org.apache.cxf:cxf-rt-rs-security-sso-oidc 3.6.9.rhlw-00002 with backported fixes for CVE-2026-57817 and CVE-2026-65583. CVE-2026-57817: Apache CXF: The authorization code hash chash is not enforced for the hybrid OIDC flow CVE-2026-65583: Apache CXF: Self-issued ID...

CVE-2026-107371 Missing Verification of auth_time Claim in auth0.js

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

CVE-2026-107371

The auth0.js library contains a vulnerability where the authorize() method fails to validate the auth_time claim in the resulting ID token against the provided maxAge parameter. This flaw allows an application to potentially process an ID token representing an authentication event that is older t...