Server-side Request Forgery (SSRF)

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the parseidtoken function in syncopenid.py and asyncopenid.py, where an ID Token containing a noncesupported: false claim causes non...

CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...