Is CVE-2026-44681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44681 being exploited in the wild.

How severe is CVE-2026-44681?

Medium severity, with a CVSS score of 6.1, published 27 May 2026.

Which products and versions are affected?

authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.12, ECOSYSTEM:introduced=1.7.0,fixed=1.7.1.

Is there a fix for CVE-2026-44681?

Yes. authlib (PyPI): upgrade to 1.6.12, 1.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44681 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44681?

Check whether you run authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44681: Authlib open redirect in OIDC Implicit and Hybrid grants

CVE-2026-44681 · Severity: medium · CVSS 6.1 · Published 2026-05-27

Authlib, a library used to implement login and authorization services, contains a flaw that allows attackers to redirect users to malicious websites. By sending a specially crafted login request that omits a required security setting, an attacker can trick the server into sending a user to a phishing page. This can be used to steal user credentials by making the malicious site appear as if it is part of a trusted login process.

Technologies: authlib (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44681 being exploited in the wild.
How severe is CVE-2026-44681?: Medium severity, with a CVSS score of 6.1, published 27 May 2026.
Which products and versions are affected?: authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.12, ECOSYSTEM:introduced=1.7.0,fixed=1.7.1.
Is there a fix for CVE-2026-44681?: Yes. authlib (PyPI): upgrade to 1.6.12, 1.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44681 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44681?: Check whether you run authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

authlib (PyPI): upgrade to 1.6.12, 1.7.1 or later
```
pip install "authlib>=1.7.1"
```

Technical details

An open redirect exists in Authlib's `OpenIDImplicitGrant` and `OpenIDHybridGrant` implementations. The vulnerability occurs because the `validate_authorization_request` method checks for the presence of the 'openid' scope before validating the `redirect_uri` against the registered client configuration. If the scope is missing, the library raises an `InvalidScopeError` that includes the unvalidated `redirect_uri` from the request payload. When this error is processed, the server issues an HTTP 302 redirect to the attacker-supplied URL. This bypasses standard OAuth 2.0 security requirements that mandate URI validation before redirection. The issue is fixed in versions 1.6.12 and 1.7.1.

Affected products

Authlib Authlib <= 1.6.11, 1.7.0

Identifiers

CVE-2026-44681
GHSA-r95x-qfjj-fjj2
PYSEC-2026-188

Timeline

2026-05-07: advisory: GitHub Advisory published
2026-05-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.