Skip to content
Fencer Vulns
medium 4.2

CVE-2026-114617 json

Authlib: ID token can disable its own nonce validation via the nonce_supported claim

published 2026-10-22 17 d ago modified 2026-10-30 9 d ago also GHSA-c5mf-xmp2-59rc , PYSEC-2026-4357 , EUVD-2026-108519

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits
0
none known

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.

Patch / fix

  • pypi authlib 1.9.0
  • authlib authlib 1.9.0
  • python-authlib Debian 14 1.9.1-1

debian advisories DEBIAN-CVE-2026-114617

  • python-Authlib openSUSE Tumbleweed 1.9.1-1.1

opensuse advisories openSUSE-SU-2026:12390-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-114617 updated cvss 6.8

authlib: Authlib: Authentication bypass via disabled nonce verification in OpenID Connect tokens

  • Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9
    affected: no fix planned “Out of support scope”
  • Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-agentic-sandbox-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9, ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat Enterprise Linux command line assistant rhel-cla/rhel-knowledge-bridge-rhel10 Red Hat OpenShift Virtualization 4 container-native-virtualization/ocp-virt-validation-checkup-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9
    affected: no fix planned “Out of support scope”
  • Red Hat Satellite 6 satellite/foreman-mcp-server-rhel9
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
16 d ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
OSV 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
GitHub 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi authlib
<1.9.0
1.9.0

Affected products

  • authlib authlib

Classification

Weakness
  • CWE-294 Authentication Bypass by Capture-replay
  • CWE-807 Reliance on Untrusted Inputs in a Security Decision

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.