CVE-2026-44681 Details
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.
An open redirect vulnerability has been identified in Authlib, a Python library for building OAuth and OpenID Connect servers. This issue affects versions prior to 1.6.12 and 1.7.1. The vulnerability allows an unauthenticated remote attacker to manipulate the authorization server into redirecting to an attacker-chosen URL. This is achieved by sending an authorization request that excludes the 'openid' scope, which triggers a validation error that includes the unvalidated redirect URI. The server then responds with an HTTP 302 redirect to the specified URL.
Users can update to Authlib versions 1.6.12 or 1.7.1, where this vulnerability has been fixed. If an immediate update is not possible, consider unregistering OpenIDImplicitGrant and OpenIDHybridGrant if they are not needed, or implementing a reverse proxy rule to reject requests that omit the 'openid' scope.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| authlib authlib | < 1.6.12 1.7.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | New CVE Received | [email protected] |