CVE-2026-44681
Fixed in a distro release EPSS <1%CVSS 6.1
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.
Products: authlib
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | authlib | 1.7.1 |
| PyPI | authlib | 1.6.12 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-3 | 3.2.1-r2 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | mlflow-fips | 3.11.1-r0 |
| Chainguard | pgadmin4 | 9.15-r1 |
| Chainguard | pgadmin4 | 9.15-r0 |
| Chainguard | pgadmin4-fips | 9.15-r0 |
| Chainguard | synapse | 1.151.0-r4 |
| Debian 12 | python-authlib | 1.2.0-1+deb12u2 |
| Debian 13 | python-authlib | no fix |
| Debian 14 | python-authlib | 1.7.2-1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-Authlib | 1.3.1-150600.3.22.1 |
| Ubuntu 25.10 | python-authlib | no fix |
| Ubuntu 26.10 | python-authlib | no fix |
| Ubuntu Pro 22.04 LTS | python-authlib | no fix |
| Ubuntu Pro 24.04 LTS | python-authlib | no fix |
| Ubuntu Pro 26.04 LTS | python-authlib | no fix |
| Wolfi | airflow-3 | 3.2.1-r2 |
| Wolfi | mlflow | 3.16.0-r0 |
| openSUSE Tumbleweed | python-Authlib | 1.7.2-1.1 |