authlib: Authlib: Open Redirect vulnerability via omitted OpenID scope in authorization request (CVE-2026-44681)

Overview

A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit an unauthenticated open redirect vulnerability in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint. By submitting an authorization request that omits the 'openid' scope, the attacker can cause the authorization server to redirect a user to an attacker-chosen URL. This could lead to information disclosure or phishing attacks.

Vendor advisories

• Red Hat VEX · Moderate · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat Quay 3 · no fix planned: Exploit Intelligence, Red Hat Quay 3, Migration Toolkit for Applications 8 · updated 2026-10-23 · vex

authlib: Authlib: Open Redirect vulnerability via omitted OpenID scope in authorization request — rated Moderate by Red Hat. Released 2026-05-27, updated 2026-10-23.

Affected:

• Exploit Intelligence
• Migration Toolkit for Applications 8
• Red Hat Quay 3

No fix planned:

• Exploit Intelligence
• Red Hat Quay 3
• Migration Toolkit for Applications 8

Not affected:

• Lightspeed Core
• OpenShift Lightspeed
• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux command line assistant
• Red Hat OpenShift Virtualization 4
• Red Hat Satellite 6

Remediation

Out of support scope

Package advisory (CVE-2026-44681)

Affected packages:

• authlib >= 1.7.0, < 1.7.1
• authlib < 1.6.12

Patched in:

• authlib 1.7.1
• authlib 1.6.12

Source: https://osv.dev/vulnerability/GHSA-r95x-qfjj-fjj2