CVE-2026-41425 Details
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11.
A cross-site request forgery (CSRF) vulnerability has been identified in Authlib, a Python library for building OAuth and OpenID Connect servers. This issue affects versions prior to 1.6.11 and arises from the lack of CSRF protection in the cache feature of 'authlib.integrations.starlette_client.OAuth'. When the cache parameter is used, there is no mechanism to tie the client to the authentication state, leaving users vulnerable to CSRF attacks. This vulnerability allows attackers to manipulate authentication flows and, in some cases, such as pushing invoices into a victim's account, could have serious consequences.
Users can update to Authlib version 1.6.11 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgv | CISA-ADP | ExploitVendor Advisory |
| https://github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgv | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| authlib authlib | < 1.6.11 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |