Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.
References
| Link | Resource |
|---|---|
| https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2 | Exploit Mitigation Vendor Advisory |
| https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2 | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Jun 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2 - Exploit, Mitigation, Vendor Advisory |
02 Jun 2026, 14:51
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Authlib
Authlib authlib |
|
| CPE | cpe:2.3:a:authlib:authlib:1.7.0:*:*:*:*:*:*:* cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:* |
|
| References | () https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2 - Exploit, Mitigation, Vendor Advisory |
27 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 20:16
Updated : 2026-06-02 17:16
NVD link : CVE-2026-44681
Mitre link : CVE-2026-44681
CVE.ORG link : CVE-2026-44681
JSON object : View
Products Affected
authlib
- authlib