Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Authlib library may load forged server addresses

CVE-2026-104056 · published 17 days ago
Summary

The Authlib Python library (versions up to 1.7.2) saves discovery information without confirming it came from the expected source. An attacker could supply false data that replaces legitimate endpoint URLs with malicious ones, potentially redirecting your application to unsafe locations. Upgrade Authlib to a newer version or apply the vendor’s fix and review your configuration to ensure only trusted sources are used.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– authlib authlib 1.7.2
Ubuntu:Pro:22.04:LTS canonical python-authlib All versions
Debian:12 debian python-authlib All versions
Original advisory text
CVE-2026-104056
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-829Inclusion of Functionality from Untrusted Control Sphere
Timeline
Published1 Oct 2026
Updated17 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-104056 · NVD
CVE-2026-104056 · MITRE
UBUNTU-CVE-2026-104056 · OSV
DEBIAN-CVE-2026-104056 · OSV
Track software like this
Free during beta