Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...

GHSA-C5MF-XMP2-59RC Authlib: ID token can disable its own nonce validation via the nonce_supported claim

Summary OpenIDMixin.parseidtoken reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonc...

Server-side Request Forgery (SSRF)

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the parseidtoken function in syncopenid.py and asyncopenid.py, where an ID Token containing a noncesupported: false claim causes non...

Replay Attack

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Replay Attack via parseidtoken in authlib/integrations/baseclient/syncopenid.py and its async counterpart, where an ID Token containing a noncesupported: false claim...