CVE-2026-116672
Authlib is a Python library which builds OAuth and OpenID Connect servers.
Impact
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | Authlib | >= 0.15, <= 1.9.0 | 1.9.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Authlib | Authlib | from 0.15, before 1.9.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-c73q-w75p-j82v
- https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v
- https://nvd.nist.gov/vuln/detail/CVE-2026-116672
- https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff
- https://github.com/authlib/authlib/releases/tag/v1.9.1