CVE-2026-44681: Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

Summary

An unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope.

Details

Vulnerable code

OpenIDImplicitGrant.validateauthorizationrequest in authlib/oidc/core/grants/implicit.py:

python def validateauthorizationrequest(self): if not isopenidscope(self.request.payload.scope): raise InvalidScopeError( "Missing 'openid' scope", redirecturi=self.request.payload.redirecturi, # ← raw, unvalidated redirectfragment=True, ) redirecturi = super().validateauthorizationrequest() ...

OpenIDHybridGrant.validateauthorizationrequest in authlib/oidc/core/grants/hybrid.py shares the same pattern.

Root cause

Both methods perform the openid scope presence check before delegating to super().validateauthorizationrequest(), which is where AuthorizationEndpointMixin.validateauthorizationredirecturi validates the requested redirecturi against the client's checkredirecturi(...). The InvalidScopeError thrown by the scope check therefore carries attacker-controlled self.request.payload.redirecturi.

OAuth2Error.call in authlib/oauth2/base.py renders any error with a non-empty redirecturi as an HTTP 302:

python def call(self, uri=None): if self.redirecturi: params = self.getbody() loc = addparamstouri(self.redirecturi, params, self.redirectfragment) return 302, "", [("Location", loc)] return super().call(uri=uri)

A malformed authorization request that selects OpenIDImplicitGrant or OpenIDHybridGrant and omits the openid scope is therefore redirected to a fully attacker-chosen URL.

This is a variant of the issue fixed in commit 3be08468 ("fix: redirecting to unvalidated redirecturi on UnsupportedResponseTypeError") that was missed in the OIDC Implicit and Hybrid grants.

Preconditions

1. The server registers OpenIDImplicitGrant or OpenIDHybridGrant (standard OIDC Implicit or Hybrid flow support). 2. The attacker's request uses a responsetype that matches either grant: idtoken, idtoken token, code idtoken, code token, or code idtoken token. 3. scope does not contain openid. 4. Any redirecturi value.

No user authentication, no consent, no valid session, no CSRF token, and — notably — no valid clientid are required. The scope check runs before any client lookup, so any clientid value (including nonexistent ones) reaches the vulnerable code path.

PoC

The following unauthenticated GET is sufficient to induce the authorization server to redirect a victim's browser to an attacker-controlled URL:

GET /oauth/authorize ?responsetype=idtoken &clientid=anything &scope=profile &redirecturi=https%3A%2F%2Fevil.example.com%2Fphish &state=s&nonce=n HTTP/1.1 Host: victim-op.example

Server response:

HTTP/1.1 302 Found Location: https://evil.example.com/phish#error=invalidscope&errordescription=Missing+%27openid%27+scope&state=s

Impact

- Open redirect from a trusted authorization server origin. Victims receiving a phishing link see the legitimate OIDC provider's domain in the URL bar at the moment they click. The authorization server itself issues the 302 to the attacker's page, lending the attacker's landing page the OP's reputation and potentially satisfying domain-allow-list controls that trust the OP. - Phishing / credential harvesting leverage. The attacker's page can mimic the legitimate OP's consent screen or a relying-party error page to solicit credentials, MFA codes, or to continue a downstream confused-deputy attack. - RFC violation. RFC 6749 §4.1.2.1 and RFC 9700 (OAuth 2.0 Security BCP) §4.11 both state that an authorization server MUST NOT perform redirection to a redirecturi that has not been validated against the client's registered URIs, even in error responses. The state parameter is echoed back, giving the attacker site a stable correlator. - No direct token/code leak. This flaw fires before any authorization decision, so no authorization codes, ID tokens, or access tokens are disclosed. The impact is limited to open-redirect phishing leverage. Combined with other issues (e.g., downstream SSO trust chains) it may contribute to account-takeover chains; on its own it is a Medium-severity open redirect.

Affected deployments

Any application using Authlib as an OIDC provider that registers OpenIDImplicitGrant and/or OpenIDHybridGrant — i.e. anyone supporting the Implicit flow or the Hybrid flow (responsetype=code idtoken, etc.) — is affected. Clients of an Authlib-based OP are not directly affected; this is a server-side issue.

Authorization servers that only register the plain AuthorizationCodeGrant (code flow, with or without PKCE and the OpenIDCode extension) are not affected by this specific variant: the code-flow grant validates redirecturi before raising scope errors. If you were affected by the sibling issue fixed in 3be08468 (UnsupportedResponseTypeError), you should already be on 1.6.10 or later; this advisory is independent of that fix.

Suggested fix

The attached fix-oidc-open-redirect.patch reorders each method to delegate to its super (or call validatecodeauthorizationrequest for Hybrid) first, and then performs the openid-scope check with the validated redirecturi variable.

python authlib/oidc/core/grants/implicit.py def validateauthorizationrequest(self): redirecturi = super().validateauthorizationrequest() # runs client + redirecturi validation if not isopenidscope(self.request.payload.scope): raise InvalidScopeError( "Missing 'openid' scope", redirecturi=redirecturi, # validated redirectfragment=True, ) try: validatenonce(self.request, self.existsnonce, required=True) except OAuth2Error as error: error.redirecturi = redirecturi error.redirectfragment = True raise error return redirecturi

An equivalent transform is applied to OpenIDHybridGrant.validateauthorizationrequest, invoking validatecodeauthorizationrequest first and only then checking isopenidscope.

Alternatively, inline a client = queryclient(request.payload.clientid) + client.checkredirecturi(request.payload.redirecturi) guard before populating redirecturi on the error — the pattern used in 3be08468.

The patch also adds regression tests analogous to testunsupportedresponsetypedoesnotredirect from commit 3be08468, asserting rv.statuscode == 400 and rv.headers.get("Location") is None for an unregistered redirecturi with a non-openid scope.

Workarounds

No clean server-side workaround exists short of patching. Partial mitigations:

- Unregister OpenIDImplicitGrant and OpenIDHybridGrant if the Implicit and Hybrid flows are not required. (RFC 9700 deprecates the Implicit flow and discourages Hybrid flows, so this is recommended anyway.) - Front the /authorize endpoint with a reverse proxy rule that rejects requests containing both a redirecturi parameter and a scope that does not include openid when responsetype matches the vulnerable set. This is fragile and not recommended as a primary control.

References

- RFC 6749, §4.1.2.1 — Error Response (OAuth 2.0 authorization endpoint) - RFC 9700, §4.11 — Redirect URI validation - OpenID Connect Core 1.0, §3.2.2.6 / §3.3.2.6 — Authentication Error Response - Authlib commit 3be08468 — prior fix for the same class of issue in UnsupportedResponseTypeError (Authlib 1.6.10) - Authlib source (by symbol; verified in commit 5d2e603e): - OpenIDImplicitGrant.validateauthorizationrequest — authlib/oidc/core/grants/implicit.py - OpenIDHybridGrant.validateauthorizationrequest — authlib/oidc/core/grants/hybrid.py - OAuth2Error.call — authlib/oauth2/base.py (renders errors with redirecturi as HTTP 302) - AuthorizationEndpointMixin.validateauthorizationredirecturi — authlib/oauth2/rfc6749/grants/base.py (the validation that is bypassed)