Executive brief
Authlib is a popular library used by developers to handle login and authentication in web applications. A security flaw exists where certain configurations fail to verify that a login request was actually started by the user completing it. This could allow an attacker to trick a victim into linking the attacker's account to the victim's profile, potentially leading to unauthorized access or data corruption.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Authlib's OAuth integrations (notably Starlette) when the 'cache' parameter is used to store authentication state. Unlike the default SessionMiddleware, the cache-based implementation fails to verify that the client initiating the authentication flow is the same one completing the redirect callback. An attacker can initiate an OAuth flow and trick a victim into following the resulting redirect URL, causing the victim to complete the authorization with the attacker's state. This violates RFC 6749 section 10.12. The issue is resolved in version 1.6.11.
Affected products
- Authlib Authlib < 1.6.11
Timeline
- 2026-04-16: disclosed
- 2026-04-16: advisory
- 2026-04-16: patched: Fixed in version 1.6.11