Vulnerability Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91
- https://github.com/authlib/authlib/releases/tag/v1.9.1
- https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v
FAQ
What is CVE-2026-116672?
CVE-2026-116672 is a vulnerability with a CVSS score of 8.8 (HIGH). Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_p...
How severe is CVE-2026-116672?
CVE-2026-116672 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116672?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.