# CVE-2026-114617: Authlib nonce validation bypass in OpenID token parsing

Source: https://junglewise.ai/threats/cve-2026-114617-authlib-is-a-python-library-which-builds-oauth-and-openid  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114617 · Severity: medium · CVSS 4.2 · Published 2026-10-22

Authlib is a Python library that implements OAuth and OpenID Connect authentication servers. In versions before 1.9.0, an attacker who obtains a validly signed ID token can replay it into a different session by exploiting a flaw where the token itself can disable nonce validation. This allows account takeover in implicit and hybrid OpenID flows, though standard authorization code flows are not affected.

Technologies: [Authlib](https://junglewise.ai/threats/technologies/authlib-authlib), [authlib (PyPI)](https://junglewise.ai/threats/technologies/authlib). Vendors: [Authlib](https://junglewise.ai/threats/vendors/authlib), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-114617 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114617 being exploited in the wild.

**How severe is CVE-2026-114617?** Medium severity, with a CVSS score of 4.2, published 22 October 2026.

**Which products and versions are affected?** Authlib before 1.9.0; authlib (PyPI) <= 1.8.0, ECOSYSTEM:introduced=0,fixed=1.9.0.

**Is there a fix for CVE-2026-114617?** Yes. authlib (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114617 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114617?** Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- authlib (PyPI): upgrade to 1.9.0 or later

  ```sh
  pip install "authlib>=1.9.0"
  ```


## Technical details

The OpenIDMixin.parse_id_token() method in both sync and async implementations trusts a nonce_supported claim from an untrusted ID token and sets the expected nonce to null when this claim is false, disabling the nonce-to-session binding check. An attacker with a valid token (that passes signature, issuer, and audience validation) can bypass nonce replay protection in implicit and hybrid relying parties or applications that directly accept externally supplied ID tokens. The fix removes this trust in the token claim and enforces nonce validation independently.

## Affected products

- Authlib Authlib before 1.9.0

## Identifiers

- CVE-2026-114617
- GHSA-c5mf-xmp2-59rc
- PYSEC-2026-4357

## Timeline

- 2026-10-22: disclosed
- 2026-10-12: patched

## References

- [https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0](https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0)
- [https://github.com/authlib/authlib/pull/949](https://github.com/authlib/authlib/pull/949)

## Related threats

- [Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib RFC 9101 server-side request forgery in request_uri parameter](https://junglewise.ai/threats/cve-2026-114620-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib OpenID Connect scope validation bypass](https://junglewise.ai/threats/cve-2026-114619-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib HMAC signature forgery with zero-length keys](https://junglewise.ai/threats/cve-2026-114616-authlib-is-a-python-library-which-builds-oauth-and-openid)