CVE-2026-41425: Authlib CSRF in OAuth integrations when using cache storage

CVE-2026-41425 · Severity: medium · CVSS 5.4 · Published 2026-04-24

Authlib is a popular library used by developers to handle login and authentication in web applications. A security flaw exists where certain configurations fail to verify that a login request was actually started by the user completing it. This could allow an attacker to trick a victim into linking the attacker's account to the victim's profile, potentially leading to unauthorized access or data corruption.

Technologies: Authlib, authlib (PyPI). Vendors: Authlib, PyPI.

Quick answers

Is CVE-2026-41425 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41425 being exploited in the wild.
How severe is CVE-2026-41425?
Medium severity, with a CVSS score of 5.4, published 24 April 2026.
Which products and versions are affected?
authlib (PyPI) < 1.6.11, ECOSYSTEM:introduced=0,fixed=1.6.11.
Is there a fix for CVE-2026-41425?
Yes. authlib (PyPI): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41425 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41425?
Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • authlib (PyPI): upgrade to 1.6.11 or later
    pip install "authlib>=1.6.11"

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Authlib's OAuth integrations (notably Starlette) when the 'cache' parameter is used to store authentication state. Unlike the default SessionMiddleware, the cache-based implementation fails to verify that the client initiating the authentication flow is the same one completing the redirect callback. An attacker can initiate an OAuth flow and trick a victim into following the resulting redirect URL, causing the victim to complete the authorization with the attacker's state. This violates RFC 6749 section 10.12. The issue is resolved in version 1.6.11.

Affected products

  • Authlib Authlib < 1.6.11

Identifiers

  • CVE-2026-41425
  • GHSA-jj8c-mmj3-mmgv
  • PYSEC-2026-25

Timeline

  • 2026-04-16: disclosed
  • 2026-04-16: advisory
  • 2026-04-16: patched: Fixed in version 1.6.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.