{"id":"CVE-2026-114620","kind":"vulnerability","aliases":["CVE-2026-114620"],"related":[],"title":"Authlib: unvetted request_uri lets custom hooks fetch internal URLs","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0.","summary":"Authlib's RFC 9101 request-object handling passes the client-supplied request_uri to the application's get_request_object() hook before any destination policy is checked. If the integrator's hook performs an unrestricted outbound fetch, a remote attacker who knows a valid public client ID can make the authorization server request internal or link-local URLs and learn fetch outcomes from error responses and timing.","severity":"medium","cvss":5.4,"epss":0.0029,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authlib","oauth","openid-connect","package","python","self-hosted"],"not_affected_if":["default-config","secure-hook"],"how_to_check":"- Check the installed Authlib version with `pip show authlib` and confirm whether it is below `1.9.0`.\n- Search the application for an implementation of `get_request_object` and check whether it makes outbound HTTP requests without an allowlist, destination controls, and retrieval limits.\n- Confirm whether the authorization server accepts RFC 9101 `request_uri` parameters.","fix":"- Upgrade Authlib to `1.9.0` or later.\n- Until upgraded, make the `get_request_object` hook enforce an allowlist, block internal and link-local destinations, and cap retrieval size and time.","status":"open","published_at":"2026-10-22T22:18:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:14:19+00:00","updated_at":"2026-10-25T04:14:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:14:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Authlib to `1.9.0` or later.\n- Until upgraded, make the `get_request_object` hook enforce an allowlist, block internal and link-local destinations, and cap retrieval size and time.","reach":"internet","title":"Authlib: unvetted request_uri lets custom hooks fetch internal URLs","impact":"medium","summary":"Authlib's RFC 9101 request-object handling passes the client-supplied request_uri to the application's get_request_object() hook before any destination policy is checked. If the integrator's hook performs an unrestricted outbound fetch, a remote attacker who knows a valid public client ID can make the authorization server request internal or link-local URLs and learn fetch outcomes from error responses and timing.","category":"package","nicknames":[],"who_cares":["python","authlib","oauth","openid-connect","self-hosted"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Server makes internal or link-local requests; fetch outcomes leak via errors and timing.","analyst_note":"","how_to_check":"- Check the installed Authlib version with `pip show authlib` and confirm whether it is below `1.9.0`.\n- Search the application for an implementation of `get_request_object` and check whether it makes outbound HTTP requests without an allowlist, destination controls, and retrieval limits.\n- Confirm whether the authorization server accepts RFC 9101 `request_uri` parameters.","needs_analyst":false,"not_affected_if":["default-config","secure-hook"],"who_is_affected":"Only deployments that use Authlib as an OAuth or OpenID Connect authorization server with RFC 9101 JWT-secured authorization requests enabled, and whose custom get_request_object hook fetches request_uri without restrictions. Deployments whose hook already applies a secure allowlist, destination controls, and retrieval limits are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":3609,"output_tokens":686,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114620':13A,16A '-2026':12A,15A '1.9.0':111C,247C '9101':30B,115C 'abstract':128C 'accept':238C 'affect':218C 'allowlist':210C 'alreadi':206C 'appli':134C,207C 'applic':44B,234C 'application-approv':233C 'approv':235C 'attack':68B,169C 'authlib':1A,17B,27B,97C,112C 'authlib/oauth2/rfc9101/authorization_server.py':223C 'author':79B,180C 'build':103C 'check':55B 'client':38B,74B,121C,175C 'client-control':120C 'client-suppli':37B 'connect':21B,107C 'control':122C,212C 'custom':6A,204C 'cve':11A,14A 'demonstr':150C 'deploy':156C,202C 'destin':52B,136C,211C,240C 'differ':197C 'distinguish':193C 'document':149C 'error':93B,198C 'fetch':8A,65B,90B,154C,166C,194C 'fix':244C 'forward':224C 'get':46B,129C,228C 'handl':34B 'hook':7A,49B,60B,132C,141C,161C,205C 'host':26B 'http':153C 'id':75B 'identifi':176C 'implement':159C,221C 'integr':58B,158C 'intern':9A,82B,183C 'issu':242C 'jwtauthenticationrequest':116C,220C 'know':70B,171C 'learn':89B 'let':5A 'librari':101C 'limit':215C 'link':85B,185C 'link-loc':84B,184C 'local':86B,186C 'make':77B,178C 'network':145C 'oauth':18B,104C 'object':33B,48B,131C,230C 'openid':20B,106C 'openid-connect':19B 'otherwis':188C 'outbound':64B,165C 'outcom':91B,195C 'packag':22B 'paramet':125C 'pass':35B,117C 'perform':61B,143C 'polici':53B,139C,237C 'prior':109C 'public':73B,174C 'python':23B,100C 'registr':138C 'remot':67B,168C 'request':3A,32B,40B,47B,81B,123C,130C,146C,182C,225C,229C 'request-object':31B 'respons':94B,199C 'retriev':214C,236C 'rfc':29B,114C 'secur':209C 'self':25B 'self-host':24B 'server':80B,108C,181C 'suppli':39B 'time':96B,201C 'unauthent':119C 'unintend':189C 'unrestrict':63B,152C,164C 'unvet':2A 'uri':4A,41B,124C,226C 'url':10A,87B,190C 'valid':72B,173C 'version':246C 'whose':157C,203C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that use Authlib as an OAuth or OpenID Connect authorization server with RFC 9101 JWT-secured authorization requests enabled, and whose custom get_request_object hook fetches request_uri without restrictions. Deployments whose hook already applies a secure allowlist, destination controls, and retrieval limits are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T22:18:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114620","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114620","severity":null,"published_at":"2026-10-22T22:18:05+00:00","modified_at":"2026-10-23T19:34:14+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114620","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114620","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}