GHSA-c73q-w75p-j82v: Authlib RFC 7592 examples omit registration-access-token client binding
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirecturis can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Authlibto a version that resolves this vulnerability.Fixed in 1.9.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed if they followed both documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations in Authlib versions from 0.15 through 1.9.1.
What does an attacker need to exploit this issue?
An attacker needs a valid registration access token for any client. The vulnerable example logic does not verify that the credential belongs to the client selected through request-controlled client_id data.
What can an attacker do with another client's registration?
They can read, modify, or delete another client's registration. Changing redirect_uris can enable authorization-code or token interception, while deletion can deny service to the affected client.
How can I determine whether my implementation is affected?
Review the implementations of ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission. An affected implementation selects the target client using request-controlled client_id and checks editability without confirming that request.credential belongs to that target client.
What is the available fix?
Upgrade to Authlib version 1.9.1, which fixes this issue. If an immediate upgrade is not possible, ensure registration-management authorization explicitly binds the presented registration access token to the client being read, modified, or deleted.