Authentication Bypass Vulnerability in Authlib Library for Python

CVE-2026-114617

What is CVE-2026-114617?

The Authlib library, which is utilized for building OAuth and OpenID Connect servers in Python, is susceptible to an authentication bypass issue. Prior to version 1.9.0, the function OpenIDMixin.parse_id_token() failed to correctly handle the 'nonce_supported' claim within untrusted ID tokens. Consequently, this flaw allows an attacker with a validly signed token to exploit nonce-to-session binding, permitting replay of the victim's token into an attacker-controlled session. It is essential to note that this vulnerability impacts implicit and hybrid relying parties, while the plain authorization code flow remains unaffected. The issue is resolved in version 1.9.0, which implements necessary safeguards against such threats.

References