# CVE-2026-41479: Authlib open redirect in OAuth 2.0 authorization endpoint

Source: https://junglewise.ai/threats/cve-2026-41479-authlib-open-redirect-in-oauth-2-0-authorization-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-41479 · Severity: medium · CVSS 5.4 · Published 2026-06-22

Authlib is a Python library used to build OAuth and OpenID Connect servers, which handle user logins and permissions for web applications. A security flaw allows attackers to use these servers as a 'jumping-off point' to redirect users to malicious websites. Because the server is trusted, users may be more likely to fall for phishing attacks or credential theft, as the initial link appears to come from a legitimate corporate login service.

Technologies: [authlib (PyPI)](https://junglewise.ai/threats/technologies/authlib). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-41479 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41479 being exploited in the wild.

**How severe is CVE-2026-41479?** Medium severity, with a CVSS score of 5.4, published 22 June 2026.

**Which products and versions are affected?** authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.10.

**Is there a fix for CVE-2026-41479?** Yes. authlib (PyPI): upgrade to 1.6.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41479 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41479?** Check whether you run authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- authlib (PyPI): upgrade to 1.6.10 or later

  ```sh
  pip install "authlib>=1.6.10"
  ```


## Technical details

An open redirect vulnerability exists in Authlib's OAuth 2.0 authorization endpoint due to improper validation order. The `AuthorizationServer.get_authorization_grant()` method copies the raw `redirect_uri` from the request into an `UnsupportedResponseTypeError` before performing client lookup or URI validation. When the application handles this error via `handle_error_response()`, the library automatically issues a 302 redirect to the attacker-supplied URI. This allows an unauthenticated attacker to craft a URL that uses the trusted authorization server to redirect victims to a malicious site. The issue is fixed in versions 1.6.10 and 1.7.1.

## Affected products

- authlib Authlib < 1.6.10, 1.7.0

## Identifiers

- CVE-2026-41479
- GHSA-w8p2-r796-3vmq
- PYSEC-2026-2119

## Timeline

- 2026-06-08: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: NVD publication date

## References

- [https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096](https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096)
- [https://github.com/authlib/authlib/security/advisories/GHSA-w8p2-r796-3vmq](https://github.com/authlib/authlib/security/advisories/GHSA-w8p2-r796-3vmq)

## Related threats

- [Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib RFC 9101 server-side request forgery in request_uri parameter](https://junglewise.ai/threats/cve-2026-114620-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib OpenID Connect scope validation bypass](https://junglewise.ai/threats/cve-2026-114619-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib nonce validation bypass in OpenID token parsing](https://junglewise.ai/threats/cve-2026-114617-authlib-is-a-python-library-which-builds-oauth-and-openid)