CVE-2026-114614: Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.issecuretransport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
authlibto a version that resolves this vulnerability.Fixed in 1.8.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Authlib versions from 0.13 through versions before 1.8.0 are affected where attacker-supplied URLs reach is_secure_transport(), including OIDC RP-Initiated Logout registration or authorization-server metadata validation.
What does an attacker need to exploit the flaw?
An external party must be able to supply a URL to an affected call site and craft it with loopback text in the userinfo component while the parsed host is a non-loopback external system. Exploitation also requires user interaction and has high attack complexity.
Does this affect the normal TLS requirement for all HTTP URLs?
The bypass applies to the loopback HTTP exemption: the vulnerable prefix comparison can treat a crafted URL as loopback even when its actual host is external. It can therefore permit cleartext redirection or acceptance of cleartext endpoints that should fail the TLS-required guard.
What should be done if an immediate upgrade is not possible?
Prevent untrusted parties from supplying URLs to affected registration, metadata-validation, or other call sites that invoke the transport-security check. In particular, reject cleartext HTTP URLs targeting non-loopback hosts based on parsed URL components rather than textual prefixes.
What is the impact boundary of this issue?
This issue does not bypass redirect URI exact matching. By itself, it does not forge tokens or authenticate users.