920 matches found
Authlib RFC 7592 examples omit registration-access-token client binding
Description Summary RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol lets a previously registered client read, update, or delete its own registration, authenticated by a registrationaccesstoken issued specifically to that client at registration time. The entire security model of...
EUVD-2026-111112
Authlib RFC 7592 examples omit registration-access-token client binding...
GHSA-C73Q-W75P-J82V Authlib RFC 7592 examples omit registration-access-token client binding
Description Summary RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol lets a previously registered client read, update, or delete its own registration, authenticated by a registrationaccesstoken issued specifically to that client at registration time. The entire security model of...
CVE-2026-116672
A flaw was found in Authlib. An authenticated remote attacker can bypass authorization controls to access, modify, or delete configurations belonging to other clients. In deployments implementing the documented reference code for dynamic client configuration, the server validates client editabili...
Authlib: OpenID Implicit Grant Checks Raw Scope Instead Of Allowed Scope Before Issuing ID Tokens
Report metadata | Field | Value | | --- | --- | | Package | "authlib" PyPI, "pkg:pypi/authlib" | | Repository | https://github.com/authlib/authlib | | Component | "authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest" | | Vulnerability class | Authorization bypass: a...
Authlib: Is_secure_transport() Loopback Exemption Can Be Bypassed With A Userinfo Component, Allowing Cleartext-HTTP URL
Summary "authlib.common.security.issecuretransport" is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback "http://" URIs. The check is implemented as a textual "str.startswith" prefix match, so ...
Authlib Incomplete Algorithm-confusion Fix Permits HMAC Forgery With Prefixed Public Keys
Summary "OctKey.importkey" carries the only guard that stops an asymmetric public key from being used as an HMAC secret in "authlib.jose". That guard is "rawkey.startswithPOSSIBLEUNSAFEKEYS" — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path...
CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...
Signature Verification Bypass
Authlib is vulnerable to a signature verification bypass. The vulnerability is due to the JsonWebSignature.deserializejson method accepting JSON Serialization JWS objects without verifying the signature or requiring a cryptographic key, which allows an attacker to provide unsigned payloads that a...
Linux Distros Unpatched Vulnerability : CVE-2026-116672
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient...
Authorization Bypass Through User-Controlled Key
Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the createconfigurationresponse method in authlib/oauth2/rfc7592/endpoint.py, where a registration access token issu...
SUSE CVE-2026-114618
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...
SUSE CVE-2026-114619
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...
SUSE CVE-2026-114620
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...
DEBIAN-CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...
CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...
CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...
UBUNTU-CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...
CVE-2026-116672 Authlib RFC 7592 examples omit registration-access-token client binding
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...
CVE-2026-116672 Authlib RFC 7592 examples omit registration-access-token client binding
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...