CVE-2026-116672 in Authlib
Summary
by MITRE • 10/27/2026
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The Authlib library serves as a foundational tool for implementing OAuth and OpenID Connect protocols within Python-based applications, facilitating secure authentication and authorization flows. However, versions ranging from 0.15 through 1.9.1 contain a critical logic flaw in the reference implementations provided for the ClientConfigurationEndpoint class. Specifically, the authenticate_client and check_permission methods are designed to handle client registration management operations such as reading, modifying, or deleting client configurations. The vulnerability arises because these functions rely on request-controlled input data, specifically the target client identifier, to locate the specific client record intended for modification. While the code verifies whether the identified client object is marked as editable, it fails to perform a crucial cross-verification step: ensuring that the credentials presented in the current request actually belong to or are authorized by that specific target client.
This oversight creates a severe authorization bypass scenario where an attacker possessing any valid registration access token can manipulate other clients within the system. Because the validation logic does not bind the session credential to the resource being accessed, authentication is effectively decoupled from authorization for these endpoints. An adversary with a legitimate but unrelated client ID and its corresponding secret or token can issue requests against arbitrary target client IDs. The server will locate those targets based on the provided identifier and proceed with the operation if the record allows edits, completely ignoring whether the requester has any relationship to that specific client entity. This represents a classic Broken Access Control vulnerability where the system fails to enforce proper policy regarding which user or service is allowed to access specific resources.
The operational impact of this flaw is significant due to the sensitive nature of OAuth and OpenID Connect configurations. If an attacker successfully modifies a target client's registration, they can alter critical parameters such as redirect URIs. By changing these endpoints, an adversary can intercept authorization codes or access tokens intended for legitimate users, leading to account takeover and unauthorized data exposure. Furthermore, if the deletion functionality is accessible through this flaw, attackers can remove client registrations entirely, resulting in a denial of service that disrupts authentication flows for affected applications. This undermines the integrity of the entire identity infrastructure managed by Authlib, as trust relationships between clients and authorization servers are compromised without any legitimate user interaction or credential compromise beyond possessing one valid token from an unrelated entity.
To mitigate this vulnerability, organizations must upgrade to version 1.9.1 or later where the logic has been corrected to properly verify that the request credentials match the target client identity before allowing modifications. For deployments still running vulnerable versions, immediate remediation involves implementing custom middleware or overriding the check_permission method to enforce strict ownership validation. This ensures that only clients with explicit permission over a specific registration can alter its settings. Additionally, security teams should audit their implementation of Authlib endpoints to ensure they do not rely solely on the default reference implementations without adding these necessary access control checks. Aligning this fix with industry standards such as CWE-284 for Improper Access Control and MITRE ATT&CK techniques related to privilege escalation or account manipulation is essential for maintaining a robust security posture in identity management systems.