Live › vulnerability › CVE-2026-114614
Go to dashboardAuthlib's transport security check treats a URL as loopback when its userinfo starts with a loopback host, even when the real host is external. An attacker who can supply a URL to OIDC logout registration, authorization-server metadata validation, or similar call sites can get cleartext redirects or cleartext endpoints accepted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use Authlib to run OAuth or OpenID Connect and accept URLs from outside parties, such as OIDC RP-Initiated Logout dynamic client registration or authorization-server metadata validation. Teams that use Authlib only with fixed, internally configured URLs and no external URL input are unlikely to be exposed.
No product ranges from the sources yet.
pip show authlib and check the installed version; versions from 0.13 up to but not including 1.8.0 are affectedis_secure_transport or OIDC RP-Initiated Logout registration that takes URLs from untrusted input1.8.0 or later with pip install -U "authlib>=1.8.0"Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114614")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.