Log in Start free

Vulnerability · Published Oct 27, 2026 · Assigned by GitHub_M

CVE-2026-116672Authlib RFC 7592 examples omit registration-access-token client binding

High 8.8

In plain English

A high-severity authorization bypass via user-controlled key in authlib from authlib. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 80.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-authlibno fix listedDEBIAN-CVE-2026-116672
Debian:13python-authlibno fix listedDEBIAN-CVE-2026-116672
Debian:14python-authlib1.9.1-1DEBIAN-CVE-2026-116672
PyPIauthlib1.9.1GHSA-c73q-w75p-j82v
Ubuntu:26.10python-authlibno fix listedUBUNTU-CVE-2026-116672

Affected products (as reported)

VendorProductVersions
authlib authlib >= 0.15, < 1.9.1

Weakness: CWE-639, CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References