Vulnerability Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Authlib | Authlib | < 1.6.12 |
Related Weaknesses (CWE)
References
- https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2ExploitMitigationVendor Advisory
- https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-44681?
CVE-2026-44681 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorizat...
How severe is CVE-2026-44681?
CVE-2026-44681 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-44681?
Check the references section above for vendor advisories and patch information. Affected products include: Authlib Authlib.