CVE-2025-68158Medium· 5.7▾ SunlitAuthlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that ha…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Last analysed / modified upstream
Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under state{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.
authlib < 1.6.6Upgrade past the affected range:
authlib 1.6.6Affected packages:
authlib >= 1.0.0, < 1.6.6Patched in:
authlib 1.6.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114620Medium· 5.4Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
CVE-2026-114618Medium· 6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audience
CVE-2026-114619Medium· 4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-114617Medium· 4.2Authlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-114616High· 7.4Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys