OpenID Implicit Grant Vulnerability in Authlib Python Library

CVE-2026-114619

What is CVE-2026-114619?

The Authlib library, essential for building OAuth and OpenID Connect servers, has a vulnerability affecting its OpenID Implicit Grant process. Specifically, prior to version 1.9.0, the method OpenIDImplicitGrant.validate_authorization_request() inadequately validates client-controlled request.payload.scope against the filtered request.scope. This flaw permits a registered client, which is allowed to receive an ID token response type but not authorized for the 'openid' scope, to include 'openid' in its request. Consequently, it can gain user consent and obtain a signed ID token containing sensitive user information. Importantly, this issue does not impact authorization code flows or deployments that allow the 'openid' scope for all clients permitted to receive ID tokens. The vulnerability is addressed in version 1.9.0 of the library.

References