Remote Code Execution Vulnerability in Authlib Python Library

CVE-2026-114620

What is CVE-2026-114620?

The Authlib Python library, utilized for building OAuth and OpenID Connect servers, presents a vulnerability in its JWT Authentication Request mechanism prior to version 1.9.0. Specifically, the issue arises from an unauthenticated, client-controlled request_uri parameter being passed to the get_request_object() hook without proper restrictions. This oversight allows a remote attacker, knowing a valid public client identifier, to make an authorization server request to unintended internal or link-local URLs. Consequently, the attacker can exploit differing error responses and timing to discern the fetch outcomes. It is critical for deployments to ensure that their implementation of this hook includes strict security measures such as secure allowlists and destination controls, as those without these safeguards are vulnerable to this attack. The vulnerability has been addressed in version 1.9.0 of Authlib.

References