---
id: "CVE-2026-114620"
kind: "vulnerability"
aliases: ["CVE-2026-114620"]
title: "Authlib: unvetted request_uri lets custom hooks fetch internal URLs"
severity: "medium"
cvss: 5.4
epss: 0.0029
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authlib", "oauth", "openid-connect", "package", "python", "self-hosted"]
not_affected_if: ["default-config", "secure-hook"]
published_at: "2026-10-22T22:18:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T04:14:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114620", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114620", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Authlib: unvetted request_uri lets custom hooks fetch internal URLs

Authlib's RFC 9101 request-object handling passes the client-supplied request_uri to the application's get_request_object() hook before any destination policy is checked. If the integrator's hook performs an unrestricted outbound fetch, a remote attacker who knows a valid public client ID can make the authorization server request internal or link-local URLs and learn fetch outcomes from error responses and timing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Authlib version with `pip show authlib` and confirm whether it is below `1.9.0`.
- Search the application for an implementation of `get_request_object` and check whether it makes outbound HTTP requests without an allowlist, destination controls, and retrieval limits.
- Confirm whether the authorization server accepts RFC 9101 `request_uri` parameters.

## Fix

- Upgrade Authlib to `1.9.0` or later.
- Until upgraded, make the `get_request_object` hook enforce an allowlist, block internal and link-local destinations, and cap retrieval size and time.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114620
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114620

## From the sources

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_