CVE-2026-114619 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...