Is CVE-2026-114620 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114620 being exploited in the wild.

How severe is CVE-2026-114620?

Medium severity, with a CVSS score of 5.4, published 22 October 2026.

Which products and versions are affected?

Authlib before 1.9.0; authlib (PyPI) >= 1.6.0, < 1.9.0, ECOSYSTEM:introduced=1.6.0,fixed=1.9.0.

Is there a fix for CVE-2026-114620?

Yes. authlib (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114620 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114620?

Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114620: Authlib RFC 9101 server-side request forgery in request_uri parameter

Q: Is there a fix for CVE-2026-114620?

Yes. authlib (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114620 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-114620?

Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114620 · Severity: medium · CVSS 5.4 · Published 2026-10-22

Authlib is a Python library for building OAuth and OpenID Connect servers. Prior to version 1.9.0, the library passes client-controlled request URIs to a retrieval hook without validating them first. If an application implements the hook as an unrestricted HTTP fetch, attackers can force the server to request internal or unintended URLs and infer outcomes from timing and error responses, enabling network reconnaissance and internal service probing.

Technologies: Authlib, authlib (PyPI). Vendors: Authlib, PyPI.

Quick answers

Is CVE-2026-114620 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114620 being exploited in the wild.
How severe is CVE-2026-114620?: Medium severity, with a CVSS score of 5.4, published 22 October 2026.
Which products and versions are affected?: Authlib before 1.9.0; authlib (PyPI) >= 1.6.0, < 1.9.0, ECOSYSTEM:introduced=1.6.0,fixed=1.9.0.
Is there a fix for CVE-2026-114620?: Yes. authlib (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114620 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114620?: Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

authlib (PyPI): upgrade to 1.9.0 or later
```
pip install "authlib>=1.9.0"
```

Technical details

Authlib's JWTAuthenticationRequest implementation forwards an unauthenticated request_uri parameter to the get_request_object() hook before applying destination validation or retrieval policies. The vulnerability is a server-side request forgery (SSRF) that requires the integrator's hook to perform an unrestricted outbound HTTP fetch; attackers need knowledge of a valid public client identifier and network access to the authorization server. Applications that already enforce allowlists, destination controls, and retrieval limits in their custom hooks are not affected.

Affected products

Authlib Authlib before 1.9.0

Identifiers

CVE-2026-114620
GHSA-x4rv-c3wx-4cr8
PYSEC-2026-4360

Timeline

2026-10-22: disclosed
2026-10-13: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.