Open Redirect Vulnerability in Authlib's OAuth and OpenID Connect Implementation
CVE-2026-44681

6.1MEDIUM

Key Information:

Vendor

Authlib

Status
Authlib
Vendor
CVE Published:
27 May 2026

What is CVE-2026-44681?

Authlib, a popular Python library for building OAuth and OpenID Connect servers, is susceptible to an open redirect vulnerability in its OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoints. This flaw allows remote attackers to manipulate the authorization process by omitting the required openid scope in an authorization request. Consequently, the authorization server may unintentionally redirect users to a malicious URL determined by the attacker, posing significant security risks. Users are advised to upgrade to versions 1.6.12 or 1.7.1 to mitigate this vulnerability.

Affected Version(s)

authlib < 1.6.12 < 1.6.12

authlib >= 1.7.0, < 1.7.1 < 1.7.0, 1.7.1

References

https://github.com/authlib/authlib/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.