CVE-2026-104056 in Authlib
Summary
by MITRE • 10/01/2026
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability in Authlib versions 1.7.2 and below stems from an insecure handling of OpenID Connect Discovery JSON metadata, specifically regarding how cached responses are validated against their source origins. In standard OAuth 2.0 and OIDC implementations, the discovery document serves as a critical trust anchor that defines endpoints for authorization, token issuance, user info retrieval, and other operations. When Authlib caches this metadata to improve performance by avoiding repeated network requests, it fails to enforce strict origin validation or issuer binding checks on subsequent uses of the cached data. This architectural flaw creates a scenario where an attacker who can manipulate the initial discovery response or intercept cache updates can inject malicious endpoint URLs that diverge from the legitimate server's domain structure.
From a technical perspective, the core issue lies in the absence of rigorous origin verification during the caching mechanism. Typically, security best practices dictate that any metadata fetched via HTTP should be validated to ensure it originates from the expected issuer and matches the configured base URL or trusted origins. In this flawed implementation, once the discovery JSON is stored in cache, subsequent authentication flows utilize these cached values without re-verifying their authenticity against the current context or performing strict origin checks. This allows a poisoned discovery response to effectively hijack the flow by replacing legitimate endpoint URLs with attacker-controlled ones. For instance, an attacker could redirect token requests or authorization callbacks to malicious servers under their control, facilitating credential theft or session manipulation.
The operational impact of this vulnerability is severe, as it directly compromises the integrity of the authentication and authorization processes. By substituting valid endpoints with malicious alternatives, attackers can intercept access tokens, refresh tokens, or user identity information during transmission. This leads to potential account takeover, unauthorized access to protected resources, and exposure of sensitive personal data. Furthermore, because the vulnerability affects cached responses, it may persist across multiple sessions for users until the cache is cleared or expires, amplifying the window of opportunity for exploitation. The lack of issuer-origin binding means that even if a user intends to interact with a legitimate service, their requests might be silently redirected to an attacker's infrastructure without any visible warning in many client configurations.
This flaw aligns closely with CWE-295 Improper Certificate Validation and CWE-384 Session Fixation through the manipulation of trusted configuration data. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with T1078 Valid Accounts and potentially T1556 Modifying Authentication Process if used to alter OAuth flows for persistent access. The exploitation vector often involves network-level attacks such as man-in-the-middle scenarios or DNS spoofing where the attacker provides a fake discovery document that appears valid but points to malicious endpoints.
To mitigate this vulnerability, organizations should immediately upgrade Authlib to version 1.7.3 or later, where these caching and validation mechanisms have been corrected. For environments unable to update promptly, implementing strict origin verification logic in custom middleware is recommended. This includes validating that all endpoint URLs returned by the discovery document share the same scheme and host as the configured issuer URL before they are cached or used. Additionally, disabling metadata caching entirely during development or testing phases can help identify misconfigurations. Security teams should also monitor for unusual redirect patterns or token requests originating from unexpected domains to detect potential exploitation attempts in real time.