CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2026-44681
Medium (6.1) in authlib authlib. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in authlib 1.6.12, 1.7.1.
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-601, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- authlib:authlib
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r95x-qfjj-fjj2 | PyPI | authlib | >=1.7.0 <1.7.1 | 1.7.1 |
| GHSA-r95x-qfjj-fjj2 | PyPI | authlib | <1.6.12 | 1.6.12 |
| PYSEC-2026-188 | PyPI | authlib | <1.6.12 | 1.6.12 |