{"id":"CVE-2026-44681","title":"authlib: Authlib: Open Redirect vulnerability via omitted OpenID scope in authorization request (CVE-2026-44681)","summary":"A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit an unauthenticated open redirect vulnerability in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization …","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"vendor","cwe":"CWE-601","vendor":"Red Hat","product":"Red Hat Quay 3","affected":["exploit_intelligence","migration_toolkit_for_applications 8","quay 3"],"patched":["authlib 1.7.1","authlib 1.6.12"],"published":"2026-05-27","updated":"2026-10-23","sourceUpdated":"2026-10-23T11:17:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44681.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44681.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44681"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482364"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44681"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44681"},{"url":"https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2"},{"url":"https://github.com/authlib/authlib"},{"url":"https://github.com/authlib/authlib/releases/tag/v1.6.12"},{"url":"https://github.com/authlib/authlib/releases/tag/v1.7.1"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/authlib/PYSEC-2026-188.yaml"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00249,"epssPercentile":0.16127,"aliases":["GHSA-r95x-qfjj-fjj2","PYSEC-2026-188"],"ecosystem":"pip","ingestedAt":"2026-09-12T03:13:01.725Z","slug":"CVE-2026-44681","body":"## Overview\n\nA flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit an unauthenticated open redirect vulnerability in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint. By submitting an authorization request that omits the 'openid' scope, the attacker can cause the authorization server to redirect a user to an attacker-chosen URL. This could lead to information disclosure or phishing attacks.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat Quay 3 · no fix planned: Exploit Intelligence, Red Hat Quay 3, Migration Toolkit for Applications 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44681.json)\n\n**authlib: Authlib: Open Redirect vulnerability via omitted OpenID scope in authorization request** — rated Moderate by Red Hat. Released 2026-05-27, updated 2026-10-23.\n\nAffected:\n\n- Exploit Intelligence\n- Migration Toolkit for Applications 8\n- Red Hat Quay 3\n\nNo fix planned:\n\n- Exploit Intelligence\n- Red Hat Quay 3\n- Migration Toolkit for Applications 8\n\nNot affected:\n\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux command line assistant\n- Red Hat OpenShift Virtualization 4\n- Red Hat Satellite 6\n\n## Remediation\n\nOut of support scope\n\n## Package advisory (CVE-2026-44681)\n\nAffected packages:\n\n- `authlib >= 1.7.0, < 1.7.1`\n- `authlib < 1.6.12`\n\nPatched in:\n\n- `authlib 1.7.1`\n- `authlib 1.6.12`\n\nSource: https://osv.dev/vulnerability/GHSA-r95x-qfjj-fjj2","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}