4 matches found
CVE-2026-114620
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...
CVE-2026-114620
The Authlib Python library (prior to version 1.9.0 ) is vulnerable to Server-Side Request Forgery (SSRF) in its RFC 9101 JWT-secured authorization request (JAR) implementation. The root cause is that the JWTAuthenticationRequest class forwards an unauthenticated, client-controlled request_uri par...
CVE-2026-114620 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...
EUVD-2026-108522
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...