PT-2026-35068 · Oauthlib · Oauthlib

Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-41425

NVD

CVSS v3.1

5.4

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette client.OAuth. This vulnerability is fixed in 1.6.11.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-41425

Affected Products

Oauthlib

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-41425 · Security Note
• https://github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgv · Note
• https://twitter.com/CVEnew/status/2047798568279494893 · Twitter Post