Read the docs
TI-2025-41738 Aliases CVE-2025-68158GHSA-fg6f-75jq-6523

Authlib: 1-click Account Takeover

Priority HIGH 71CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00272 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial authlib (authlib): 1.6.6authlib (PyPI): 1.6.6Red Hat: 4 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
authlibauthlib1.0.0 to before 1.6.61.6.6Patch availableCNA
—authlib (PyPI)1.0.0 to before 1.6.61.6.6Patch availableGHSA-fg6f-75jq-6523
  • authlib Vendorauthlib Affected 1.0.0 to before 1.6.6 Fixed in 1.6.6 Patch available CNA
  • authlib (PyPI) Vendor— Affected 1.0.0 to before 1.6.6 Fixed in 1.6.6 Patch available GHSA-fg6f-75jq-6523

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*before 1.6.6Vulnerableauthlib
  • cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:* Versions before 1.6.6 Vulnerable ·authlib

Remediation

  • Fix · CNA authlib (authlib) Fixed in 1.6.6
  • Fix · GHSA-fg6f-75jq-6523 authlib (PyPI) Fixed in 1.6.6 Advisory →

Red Hat 4 advisories

  • RHSA-2026:28405 Released 2026-06-23 · Red Hat rating Important
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:6568 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.15.4
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:6567 Released 2026-04-03 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
Show 1 more Red Hat advisories
  • RHSA-2026:6497 Released 2026-04-02 · Red Hat rating Important
    Red Hat Quay 3.16.3
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Quay 3.15Fixed RHSA-2026:6568
Red Hat Quay 3.16Fixed RHSA-2026:6497, RHSA-2026:6567
Red Hat Satellite 6.18Fixed RHSA-2026:28405
Not affected: 3 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68158
  2. 2026-10-03 Alias added: GHSA-fg6f-75jq-6523

References

Exploit 1

Patch 2

Advisory 1

Other 1

  • TI-2026-22305 Authlib JWS JWK Header Injection: Signature Verification Bypass CVSS 3.1CRITICAL 9.1
  • TI-2026-79518 Authlib fix bypass lets attackers forge HS256 tokens with PEM keys CVSS 3.1CRITICAL 9.1
  • TI-2025-36973 Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) CVSS 3.1HIGH 7.5
  • TI-2024-25068 lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. CVSS 3.1HIGH 7.5
  • TI-2026-22761 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding CVSS 4.0HIGH 8.2
  • TI-2026-22754 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle CVSS 4.0HIGH 8.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences