Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled requesturi authorization parameter straight to the getrequestobject fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this requesturis client metadata...