UBUNTU-CVE-2026-116672: Ubuntu/python-authlib vulnerability

Published Oct 27, 2026

Updated

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirecturis can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.

Affected Software

4 affected components

ubuntu/python-authlib*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Authlib to a version that resolves this vulnerability.
Fixed in 1.9.1

Event History

Oct 27, 2026

CVE Published

via OSV·05:16 PM

Data Sourced

via OSV·05:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments are affected if they use Authlib from 0.15 through 1.9.1 and follow both documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations. The issue concerns OAuth or OpenID Connect server deployments using client registration management.

What does an attacker need to exploit it?

An attacker needs a valid registration access token for any client. The vulnerable example logic does not verify that the credential belongs to the client identified by request-controlled client_id data.

What could an attacker do with another client's registration?

They may be able to read, modify, or delete another client's registration. Modifying redirect_uris can enable authorization code or token interception, and deleting a registration can deny service to the affected client.

What should be done if upgrading cannot happen immediately?

Do not rely on the affected reference implementations as written. Ensure authentication and permission checks verify that request.credential belongs to the target client identified by client_id before allowing registration read, modification, or deletion.

UBUNTU-CVE-2026-116672: Ubuntu/python-authlib vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What could an attacker do with another client's registration?

What should be done if upgrading cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What could an attacker do with another client's registration?

What should be done if upgrading cannot happen immediately?