CVE-2026-114619

Name	CVE-2026-114619
Description	Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user's subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-authlib (PTS)	bookworm	1.2.0-1+deb12u1	vulnerable
	bookworm (security)	1.2.0-1+deb12u2	vulnerable
	trixie	1.6.0-1+deb13u1	vulnerable
	forky, sid	1.7.2-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-authlib	source	(unstable)	(unfixed)

Notes

https://github.com/authlib/authlib/security/advisories/GHSA-q686-2qmg-hqc7
https://github.com/authlib/authlib/pull/945
Fixed by: https://github.com/authlib/authlib/commit/e3bd41cb29dcfee434453b135ffb487884baeedf (v1.9.0)