CVE-2026-104056

Name	CVE-2026-104056
Description	Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151845

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-authlib (PTS)	bookworm	1.2.0-1+deb12u1	vulnerable
	bookworm (security)	1.2.0-1+deb12u2	vulnerable
	trixie	1.6.0-1+deb13u1	vulnerable
	forky, sid	1.7.2-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-authlib	source	(unstable)	(unfixed)			1151845

https://uziii2208.github.io/post/cve-2026-104056/