CVE-2026-116672: Authlib RFC 7592 examples omit registration-access-token client binding
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirecturis can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Authlibto a version that resolves this vulnerability.Fixed in 1.9.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Authlib from 0.15 through 1.9.0 may be exposed if they implemented both the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission examples. The issue affects OAuth or OpenID Connect server deployments that rely on those reference implementations for dynamic client registration management.
What does an attacker need to exploit this?
An attacker needs a valid registration access token for any client. With that token, they can target another client by supplying its client_id, because the vulnerable examples do not verify that the credential belongs to the target client.
What could an attacker do with another client's registration?
They can read, modify, or delete the other client's registration. Changing redirect_uris can enable authorization code or token interception, and deleting a registration can deny service to the affected client.
What should be done if upgrading is not immediately possible?
Update the authentication and permission logic so that request.credential is verified as belonging to the client identified by the request's client_id before allowing registration access. The documented examples' editable-client check alone is insufficient.
How can I determine whether my implementation is affected?
Review custom ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission implementations based on Authlib documentation. They are affected if they obtain the target client from request-controlled client_id data and only check that it is editable, without checking that request.credential belongs to that target client.