Live › vulnerability › CVE-2026-116672
Go to dashboardAuthlib's documented ClientConfigurationEndpoint examples look up the target client from request data without checking that the caller's registration token belongs to it. A client holding any valid registration access token can read, change redirect URIs of, or delete another client's registration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Applications that run an OAuth or OpenID Connect server built on Authlib and expose dynamic client registration configuration endpoints, following the documented ClientConfigurationEndpoint reference implementations. Systems that only use Authlib as an OAuth client, or that do not expose the client configuration endpoint, are not exposed by this flaw.
No product ranges from the sources yet.
pip show authlib and look for versions from 0.15 up to but not including 1.9.1ClientConfigurationEndpoint and confirm whether authenticate_client and check_permission verify that request.credential belongs to the target client1.9.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-116672")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.