Executive brief
Authlib is a Python library used to build OAuth and OpenID Connect servers, which handle user logins and permissions for web applications. A security flaw allows attackers to use these servers as a 'jumping-off point' to redirect users to malicious websites. Because the server is trusted, users may be more likely to fall for phishing attacks or credential theft, as the initial link appears to come from a legitimate corporate login service.
Technical details
An open redirect vulnerability exists in Authlib's OAuth 2.0 authorization endpoint due to improper validation order. The `AuthorizationServer.get_authorization_grant()` method copies the raw `redirect_uri` from the request into an `UnsupportedResponseTypeError` before performing client lookup or URI validation. When the application handles this error via `handle_error_response()`, the library automatically issues a 302 redirect to the attacker-supplied URI. This allows an unauthenticated attacker to craft a URL that uses the trusted authorization server to redirect victims to a malicious site. The issue is fixed in versions 1.6.10 and 1.7.1.
Affected products
- authlib Authlib < 1.6.10, 1.7.0
Timeline
- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date