CVE-2026-114617

The Authlib Python library, used for building OAuth and OpenID Connect servers, contains a vulnerability in versions prior to 1.9.0 . The OpenIDMixin.parse_id_token() function incorrectly trusts the nonce_supported claim from an untrusted ID token. When this claim is set to false , the library se...

CVE-2026-114617 Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parseidtoken reads the noncesupported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid...