Fluid Attacks Database

Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	python-authlib	=1.6.0-1 \|\| =1.6.0-1+deb13u1 \|\| =1.6.1-1 \|\| =1.6.3-1 \|\| =1.6.4-1 \|\| =1.6.5-1 \|\| =1.6.6-1 \|\| =1.6.7-1 \|\| =1.6.8-1 \|\| =1.6.9-1 \|\| =1.7.0-1 \|\| =1.7.2-1 \|\| =1.7.2-2	-
pypi	authlib	=1.7.0 \|\| >=1.7.0 <1.7.1 \|\| >=0 <1.6.12	1.7.1, 1.6.12
debian 12	python-authlib	=1.2.0-1 \|\| =1.2.0-1+deb12u1 \|\| >=0 <1.2.0-1+deb12u2	1.2.0-1+deb12u2
debian 14	python-authlib	=1.6.0-1 \|\| =1.6.1-1 \|\| =1.6.3-1 \|\| =1.6.4-1 \|\| =1.6.5-1 \|\| =1.6.6-1 \|\| =1.6.7-1 \|\| =1.6.8-1 \|\| =1.6.9-1 \|\| =1.7.0-1 \|\| >=0 <1.7.2-1	1.7.2-1

Aliases

1. CVE-2026-446812. NVD-2026-446813. OSV-DEBIAN-2026-446814. OSV-2026-446815. GHSA-r95x-qfjj-fjj26. GCVE-2026-446817. SECURITY-TRACKER-CVE-2026-44681

References

1. https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj22. https://github.com/authlib/authlib/releases/tag/v1.6.123. https://github.com/authlib/authlib/releases/tag/v1.7.14. https://github.com/pypa/advisory-database/tree/main/vulns/authlib/PYSEC-2026-188.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.