Authlib: Unvalidated Request_uri Fetch In JWT-secured Authorization Request (JAR) Leading To SSRF

Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled "requesturi" authorization parameter straight to the "getrequestobject" fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this "requesturis" client...

UBUNTU-CVE-2026-114620

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled requesturi parameter to the abstract getrequestobject hook before applying a destination or registration policy; the...

Linux Distros Unpatched Vulnerability : CVE-2026-114620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticate...

Authlib server request forgery vulnerability

Versions of Authlib prior to 1.9.0 contain a server-side request forgery vulnerability. This vulnerability stems from RFC 9101: JWTAuthenticationRequest passes an unauthenticated, client-controlled requesturi parameter to the getrequestobject hook before applying the target application or...