CVE-2026-104056
Low risk· EPSS 1%Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
Risk Assessment
An attacker can replace authentication endpoints, potentially leading to session hijacking or credential theft.
Recommendation
Update Authlib to a version newer than 1.7.2 and implement origin validation and issuer binding for cached discovery metadata.
Other vulnerabilities in Authlib
See all- CVE-2026-96760Critical
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
- CVE-2026-27962Critical
A vulnerability in the Authlib library (versions prior to 1.6.9) allows an attacker to inject a JWK key into the JWT header. This enables forging arbitrary JWT tokens that pass signature verification, as the library uses the attacker-supplied key instead of a trusted server key.
- CVE-2026-28802Critical
Authlib versions 1.6.5 to 1.6.6 incorrectly passed malicious JWT tokens with 'alg: none' and an empty signature, bypassing signature verification. The issue is fixed in version 1.6.7.
- CVE-2026-28498High
A vulnerability was found in the Authlib library (versions before 1.6.9) in the validation of OpenID Connect ID Tokens. The _verify_hash function incorrectly accepts unsupported cryptographic algorithms by returning True instead of rejecting the token. This allows an attacker to bypass token integrity by providing a forged token with an unknown algorithm.
Original NVD description (English source)
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS