Is CVE-2026-114617 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114617 being exploited in the wild.

How severe is CVE-2026-114617?

Medium severity, with a CVSS score of 4.2, published 22 October 2026.

Which products and versions are affected?

Authlib before 1.9.0; authlib (PyPI) <= 1.8.0, ECOSYSTEM:introduced=0,fixed=1.9.0.

Is there a fix for CVE-2026-114617?

Yes. authlib (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114617 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114617?

Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114617: Authlib nonce validation bypass in OpenID token parsing

Q: Is there a fix for CVE-2026-114617?

Yes. authlib (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114617 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114617?

Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114617 · Severity: medium · CVSS 4.2 · Published 2026-10-22

Authlib is a Python library that implements OAuth and OpenID Connect authentication servers. In versions before 1.9.0, an attacker who obtains a validly signed ID token can replay it into a different session by exploiting a flaw where the token itself can disable nonce validation. This allows account takeover in implicit and hybrid OpenID flows, though standard authorization code flows are not affected.

Technologies: Authlib, authlib (PyPI). Vendors: Authlib, PyPI.

Quick answers

Is CVE-2026-114617 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114617 being exploited in the wild.
How severe is CVE-2026-114617?: Medium severity, with a CVSS score of 4.2, published 22 October 2026.
Which products and versions are affected?: Authlib before 1.9.0; authlib (PyPI) <= 1.8.0, ECOSYSTEM:introduced=0,fixed=1.9.0.
Is there a fix for CVE-2026-114617?: Yes. authlib (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114617 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114617?: Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

authlib (PyPI): upgrade to 1.9.0 or later
```
pip install "authlib>=1.9.0"
```

Technical details

The OpenIDMixin.parse_id_token() method in both sync and async implementations trusts a nonce_supported claim from an untrusted ID token and sets the expected nonce to null when this claim is false, disabling the nonce-to-session binding check. An attacker with a valid token (that passes signature, issuer, and audience validation) can bypass nonce replay protection in implicit and hybrid relying parties or applications that directly accept externally supplied ID tokens. The fix removes this trust in the token claim and enforces nonce validation independently.

Affected products

Authlib Authlib before 1.9.0

Identifiers

CVE-2026-114617
GHSA-c5mf-xmp2-59rc
PYSEC-2026-4357

Timeline

2026-10-22: disclosed
2026-10-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.