Is CVE-2026-41479 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41479 being exploited in the wild.

How severe is CVE-2026-41479?

Medium severity, with a CVSS score of 5.4, published 22 June 2026.

Which products and versions are affected?

authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.10.

Is there a fix for CVE-2026-41479?

Yes. authlib (PyPI): upgrade to 1.6.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41479 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41479?

Check whether you run authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41479: Authlib open redirect in OAuth 2.0 authorization endpoint

CVE-2026-41479 · Severity: medium · CVSS 5.4 · Published 2026-06-22

Authlib is a Python library used to build OAuth and OpenID Connect servers, which handle user logins and permissions for web applications. A security flaw allows attackers to use these servers as a 'jumping-off point' to redirect users to malicious websites. Because the server is trusted, users may be more likely to fall for phishing attacks or credential theft, as the initial link appears to come from a legitimate corporate login service.

Technologies: authlib (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-41479 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41479 being exploited in the wild.
How severe is CVE-2026-41479?: Medium severity, with a CVSS score of 5.4, published 22 June 2026.
Which products and versions are affected?: authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.10.
Is there a fix for CVE-2026-41479?: Yes. authlib (PyPI): upgrade to 1.6.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41479 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41479?: Check whether you run authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

authlib (PyPI): upgrade to 1.6.10 or later
```
pip install "authlib>=1.6.10"
```

Technical details

An open redirect vulnerability exists in Authlib's OAuth 2.0 authorization endpoint due to improper validation order. The `AuthorizationServer.get_authorization_grant()` method copies the raw `redirect_uri` from the request into an `UnsupportedResponseTypeError` before performing client lookup or URI validation. When the application handles this error via `handle_error_response()`, the library automatically issues a 302 redirect to the attacker-supplied URI. This allows an unauthenticated attacker to craft a URL that uses the trusted authorization server to redirect victims to a malicious site. The issue is fixed in versions 1.6.10 and 1.7.1.

Affected products

authlib Authlib < 1.6.10, 1.7.0

Identifiers

CVE-2026-41479
GHSA-w8p2-r796-3vmq
PYSEC-2026-2119

Timeline

2026-06-08: advisory: GitHub Security Advisory published
2026-06-22: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.