---
id: CVE-2026-44681
title: >-
  authlib: Authlib: Open Redirect vulnerability via omitted OpenID scope in
  authorization request (CVE-2026-44681)
summary: >-
  A flaw was found in Authlib, a Python library for building OAuth and OpenID
  Connect servers. A remote attacker can exploit an unauthenticated open
  redirect vulnerability in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant
  authorization …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: vendor
cwe: CWE-601
vendor: Red Hat
product: Red Hat Quay 3
affected:
  - exploit_intelligence
  - migration_toolkit_for_applications 8
  - quay 3
patched:
  - authlib 1.7.1
  - authlib 1.6.12
published: '2026-05-27'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T11:17:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44681.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44681.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44681'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2482364'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44681'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44681'
  - url: 'https://github.com/authlib/authlib/security/advisories/GHSA-r95x-qfjj-fjj2'
  - url: 'https://github.com/authlib/authlib'
  - url: 'https://github.com/authlib/authlib/releases/tag/v1.6.12'
  - url: 'https://github.com/authlib/authlib/releases/tag/v1.7.1'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/authlib/PYSEC-2026-188.yaml
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00249
epssPercentile: 0.16127
aliases:
  - GHSA-r95x-qfjj-fjj2
  - PYSEC-2026-188
ecosystem: pip
ingestedAt: '2026-09-12T03:13:01.725Z'
---

## Overview

A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit an unauthenticated open redirect vulnerability in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint. By submitting an authorization request that omits the 'openid' scope, the attacker can cause the authorization server to redirect a user to an attacker-chosen URL. This could lead to information disclosure or phishing attacks.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat Quay 3 · no fix planned: Exploit Intelligence, Red Hat Quay 3, Migration Toolkit for Applications 8 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44681.json)

**authlib: Authlib: Open Redirect vulnerability via omitted OpenID scope in authorization request** — rated Moderate by Red Hat. Released 2026-05-27, updated 2026-10-23.

Affected:

- Exploit Intelligence
- Migration Toolkit for Applications 8
- Red Hat Quay 3

No fix planned:

- Exploit Intelligence
- Red Hat Quay 3
- Migration Toolkit for Applications 8

Not affected:

- Lightspeed Core
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux command line assistant
- Red Hat OpenShift Virtualization 4
- Red Hat Satellite 6

## Remediation

Out of support scope

## Package advisory (CVE-2026-44681)

Affected packages:

- `authlib >= 1.7.0, < 1.7.1`
- `authlib < 1.6.12`

Patched in:

- `authlib 1.7.1`
- `authlib 1.6.12`

Source: https://osv.dev/vulnerability/GHSA-r95x-qfjj-fjj2