PT-2026-40589 · Pypi · Oauthlib

Y011D4 · Published 2026-05-13 · Updated 2026-05-28 · CVE-2026-44681

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.12 Authlib versions prior to 1.7.1

Description An unauthenticated open redirect exists in the authorization endpoint of the OpenIDImplicitGrant and OpenIDHybridGrant components. A remote attacker can cause the authorization server to issue an HTTP 302 redirect to an arbitrary, attacker-chosen URL by submitting an authorization request that omits the openid scope. This occurs because the validate authorization request() function in both grants performs the scope check before validating the redirect uri against the registered client URIs. Consequently, the InvalidScopeError is triggered using an unvalidated redirect uri variable, which the OAuth2Error. call function then processes as a redirect location.

Recommendations Update to version 1.6.12 or 1.7.1. As a temporary mitigation, unregister OpenIDImplicitGrant and OpenIDHybridGrant if Implicit and Hybrid flows are not required.

Fix

Open Redirect

Incorrect Authorization

Weakness Enumeration

CWE-601

CWE-863

Related Identifiers

CVE-2026-44681

GHSA-R95X-QFJJ-FJJ2

OPENSUSE-SU-2026:10883-1

Affected Products

Oauthlib

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-44681 · Security Note
• https://osv.dev/vulnerability/GHSA-r95x-qfjj-fjj2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10883-1 · Vendor Advisory
• https://github.com/authlib/authlib · Note
• https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2 · Note
• https://github.com/authlib/authlib/releases/tag/v1.7.1 · Note
• https://github.com/authlib/authlib/releases/tag/v1.6.12 · Note
• https://suse.com/security/cve/CVE-2026-44681 · Note
• https://t.me/CVEtracker/55154 · Telegram Post