Client Verification Flaw in Authlib Python Library

CVE-2026-116672

What is CVE-2026-116672?

The Authlib Python library, used for building OAuth and OpenID Connect servers, has a client verification flaw in versions from 0.15 to 1.9.1. The issue arises when the library retrieves a client using client_id data controlled by requests, failing to verify that the provided credential truly corresponds to the target client. This oversight could permit a malicious client with a valid registration access token to manipulate, view, or erase another client's registration details. Such vulnerabilities enable unauthorized alterations of redirect URIs, risking interception of authorization codes or tokens, and could lead to denial of service for affected clients. This issue has been addressed in version 1.9.1.

References