{"id":"CVE-2026-114614","kind":"vulnerability","aliases":["CVE-2026-114614"],"related":[],"title":"Authlib: TLS guard bypass lets cleartext OAuth endpoints be accepted","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.","summary":"Authlib's transport security check treats a URL as loopback when its userinfo starts with a loopback host, even when the real host is external. An attacker who can supply a URL to OIDC logout registration, authorization-server metadata validation, or similar call sites can get cleartext redirects or cleartext endpoints accepted.","severity":"low","cvss":2.6,"epss":0.00177,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authlib","oauth","oidc","package","python"],"not_affected_if":["no-oidc-logout-registration","no-untrusted-url-input"],"how_to_check":"- Run `pip show authlib` and check the installed version; versions from `0.13` up to but not including `1.8.0` are affected\n- Search the code for `is_secure_transport` or OIDC RP-Initiated Logout registration that takes URLs from untrusted input","fix":"- Upgrade Authlib to `1.8.0` or later with `pip install -U \"authlib>=1.8.0\"`","status":"open","published_at":"2026-10-22T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:48:15+00:00","updated_at":"2026-10-25T04:48:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:48:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Authlib to `1.8.0` or later with `pip install -U \"authlib>=1.8.0\"`","reach":"network","title":"Authlib: TLS guard bypass lets cleartext OAuth endpoints be accepted","impact":"low","summary":"Authlib's transport security check treats a URL as loopback when its userinfo starts with a loopback host, even when the real host is external. An attacker who can supply a URL to OIDC logout registration, authorization-server metadata validation, or similar call sites can get cleartext redirects or cleartext endpoints accepted.","category":"package","nicknames":[],"who_cares":["python","authlib","oauth","oidc"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Cleartext redirects and cleartext OAuth endpoints accepted; no token forgery","analyst_note":"","how_to_check":"- Run `pip show authlib` and check the installed version; versions from `0.13` up to but not including `1.8.0` are affected\n- Search the code for `is_secure_transport` or OIDC RP-Initiated Logout registration that takes URLs from untrusted input","needs_analyst":false,"not_affected_if":["no-untrusted-url-input","no-oidc-logout-registration"],"who_is_affected":"Applications that use Authlib to run OAuth or OpenID Connect and accept URLs from outside parties, such as OIDC RP-Initiated Logout dynamic client registration or authorization-server metadata validation. Teams that use Authlib only with fixed, internally configured URLs and no external URL input are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.001104,"input_tokens":3577,"output_tokens":1492,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-114614':13A,16A '-2026':12A,15A '0.13':88C '1.8.0':90C,220C 'abl':131C 'accept':10A,74B,115C,164C 'anoth':149C 'attack':48B 'authent':185C 'authlib':1A,17B,22B,75C 'authlib.common.security.is':91C,189C 'authlib/common/security.py':194C 'author':59B,144C 'authorization-serv':58B,143C 'begin':108C 'build':81C 'bypass':4A,153C,172C 'call':65B,150C 'caus':160C 'check':26B 'cleartext':6A,69B,72B,161C,166C 'client':206C 'comparison':98C 'compon':198C 'connect':85C 'consum':210C 'cve':11A,14A 'dynam':205C 'endpoint':8A,73B,167C 'enforc':211C 'even':40B,116C 'exact':175C 'exempt':102C 'extern':46B,123C,129C 'fix':217C 'forg':182C 'get':68B 'guard':3A,158C 'host':39B,44B,112C,120C 'http':101C 'implement':192C 'initi':140C,203C 'issu':169C,215C 'let':5A 'librari':79C 'logout':56B,141C,204C 'loopback':31B,38B,100C,111C,126C 'match':176C 'metadata':61B,146C 'misinterpret':195C 'non':125C 'non-loopback':124C 'oauth':7A,18B,82C 'oidc':19B,55B,137C,200C 'openid':84C 'packag':20B 'pars':119C 'parti':130C 'prefix':97C 'python':21B,78C 'real':43B 'redirect':70B,162C,173C 'registr':57B,142C,207C 'requir':157C 'rp':139C,202C 'rp-initi':138C,201C 'secur':25B,92C,190C,213C 'server':60B,86C,145C 'similar':64B 'site':66B,151C 'start':35B 'suppli':51B,133C 'system':127C 'textual':96C 'tls':2A,156C 'tls-requir':155C 'token':183C 'transport':24B,93C,191C,212C 'treat':27B 'uri':174C 'url':29B,53B,105C,135C 'use':94C 'user':186C 'userinfo':34B,107C,197C 'valid':62B,147C 'version':219C 'vulner':188C 'whose':106C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Authlib to run OAuth or OpenID Connect and accept URLs from outside parties, such as OIDC RP-Initiated Logout dynamic client registration or authorization-server metadata validation. Teams that use Authlib only with fixed, internally configured URLs and no external URL input are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T21:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114614","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114614","severity":null,"published_at":"2026-10-22T21:17:16+00:00","modified_at":"2026-10-23T19:34:14+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114614","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114614","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}