CVE-2026-41425
Fixed in a distro release EPSS <1%CVSS 5.4
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11.
Products: authlib
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | authlib | 1.6.11 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.2-r8 |
| Chainguard | airflow-3 | 3.2.1-r0 |
| Chainguard | datahub-ingestion | 1.5.0.3-r0 |
| Chainguard | datahub-ingestion-fips | 1.5.0.1-r2 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | mlflow | 3.11.1-r0 |
| Chainguard | open-webui | 0.9.2-r0 |
| Chainguard | open-webui | 0.8.12-r4 |
| Chainguard | pgadmin4-fips | 9.14-r1 |
| Debian 12 | python-authlib | 1.2.0-1+deb12u2 |
| Debian 13 | python-authlib | no fix |
| Debian 14 | python-authlib | 1.7.0-1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-Authlib | 1.3.1-150600.3.22.1 |
| Ubuntu 25.10 | python-authlib | no fix |
| Ubuntu 26.10 | python-authlib | no fix |
| Ubuntu Pro 22.04 LTS | python-authlib | 0.15.5-1ubuntu0.1~esm2 |
| Ubuntu Pro 24.04 LTS | python-authlib | 1.3.0-1ubuntu0.1~esm2 |
| Ubuntu Pro 26.04 LTS | python-authlib | 1.6.7-1ubuntu0.1~esm1 |
| Wolfi | airflow-3 | 3.2.1-r0 |
| Wolfi | mlflow | 3.11.1-r0 |
| Wolfi | mlflow | 3.16.0-r0 |
| Wolfi | open-webui | 0.9.2-r0 |
| Wolfi | open-webui | 0.8.12-r4 |