216 matches found
EEF-CVE-2026-117656 Unverified Sign in with Apple callback parameter can override verified ID token claims
Summary Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the...
CLEANSTART-2026-KO00783 FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so an attacker able to present a forged or unsigned (`alg:none`) ID token to the OAuth callbac...
Security vulnerability affects the airflow-3 package. The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an...
Authlib: OpenID Implicit Grant Checks Raw Scope Instead Of Allowed Scope Before Issuing ID Tokens
Report metadata | Field | Value | | --- | --- | | Package | "authlib" PyPI, "pkg:pypi/authlib" | | Repository | https://github.com/authlib/authlib | | Component | "authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest" | | Vulnerability class | Authorization bypass: a...
Authlib: ID Token Can Disable Its Own Nonce Validation Via The Nonce_supported Claim
Summary "OpenIDMixin.parseidtoken" reads the "noncesupported" claim from the ID token it is validating. When that claim is boolean "false", the expected nonce is set to "None" and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session...
SUSE CVE-2026-114619
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...
GHSA-C5MF-XMP2-59RC Authlib: ID token can disable its own nonce validation via the nonce_supported claim
Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...
GHSA-Q686-2QMG-HQC7 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Report metadata | Field | Value | | --- | --- | | Package | authlib PyPI, pkg:pypi/authlib | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validateauthorizationrequest | | Vulnerability class | Authorization bypass: a...
EUVD-2026-108521
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens...
UBUNTU-CVE-2026-114619
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...
Linux Distros Unpatched Vulnerability : CVE-2026-114619
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the...
PT-2026-121757
The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...
DEBIAN-CVE-2026-114619
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...
PYSEC-2026-4359
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...
PYSEC-2026-4357
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid...
CVE-2026-114619
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...
PYSEC-2026-4359
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...
CVE-2026-114619
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...
CVE-2026-114619
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...