CVE-2026-114617

Name	CVE-2026-114617
Description	Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151845

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-authlib (PTS)	bookworm	1.2.0-1+deb12u1	vulnerable
	bookworm (security)	1.2.0-1+deb12u2	vulnerable
	trixie	1.6.0-1+deb13u1	vulnerable
	forky, sid	1.9.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-authlib	source	(unstable)	1.9.1-1			1151845

Notes

https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc
https://github.com/authlib/authlib/pull/949
Fixed by: https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0 (v1.9.0)