Authentication Bypass Vulnerability in Authlib Python Library

CVE-2026-114614

What is CVE-2026-114614?

The Authlib Python library, used to build OAuth and OpenID Connect servers, contains a vulnerability in the function handling secure transport. Specifically, the function authlib.common.security.is_secure_transport() erroneously allows a URL with a userinfo component starting with a loopback host to pass through security checks, even if the actual host is an external, non-loopback server. This flaw enables potential attackers to redirect users to cleartext endpoints or manipulate secure redirection requests if they can supply a crafted URL for OIDC RP-Initiated Logout registration or other associated processes. It’s important to note that the vulnerability does not affect redirect URI exact matching nor does it facilitate token forging or user authentication. The issue was rectified in version 1.8.0 of Authlib.

References