TI-2026-79517 Aliases CVE-2026-114614 GHSA-jj7h-c3hg-m23x

Authlib TLS check bypass lets cleartext URLs reach external hosts

MEDIUM 50CWE-601Published 2026-10-22 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Spoofing, Security bypass, Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601, CWE-693 and CWE-319.

Summary

Authlib versions from 0.13 before 1.8.0 are affected, a Python library for building OAuth and OpenID Connect servers. Its is_secure_transport() function checks loopback HTTP exemptions with a textual prefix match, so a URL whose userinfo starts with a loopback host passes even when its real host is external (CWE-693). An external party who can supply a URL to OIDC RP-Initiated Logout registration or authorization server metadata validation can bypass the TLS requirement, causing cleartext redirection or acceptance of cleartext endpoints. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00273 19th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial authlib (authlib): 1.8.0authlib (PyPI): 1.8.0Red Hat: 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
authlib	authlib	before 1.8.0	1.8.0	Patch available	CNA
—	authlib (PyPI)	before 1.8.0	1.8.0	Patch available	GHSA-jj7h-c3hg-m23x

authlib Vendorauthlib Affected before 1.8.0 Fixed in 1.8.0 Patch available CNA
authlib (PyPI) Vendor— Affected before 1.8.0 Fixed in 1.8.0 Patch available GHSA-jj7h-c3hg-m23x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:authlib:authlib::::::::	0.13 to before 1.8.0	Vulnerable	authlib

cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:* Versions 0.13 to before 1.8.0 Vulnerable ·authlib

Remediation

Upgrade the PyPI package authlib to version 1.8.0. The sources list no fixed version for Exploit Intelligence and Red Hat Quay 3, and for Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2 and Red Hat Enterprise Linux command line assistant, and other products.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA authlib (authlib) Fixed in 1.8.0
Fix · GHSA-jj7h-c3hg-m23x authlib (PyPI) Fixed in 1.8.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Exploit Intelligence	Affected	No fix planned: Out of support scope
Lightspeed Core	Affected	No fix yet: Fix deferred
Migration Toolkit for Applications 8	Affected	No fix yet: Fix deferred
OpenShift Lightspeed	Affected	No fix yet: Fix deferred
Red Hat Ansible Automation Platform 2	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux command line assistant	Affected	No fix yet: Fix deferred
Red Hat OpenShift Virtualization 4	Affected	No fix yet: Fix deferred
Red Hat Quay 3	Affected	No fix planned: Out of support scope
Red Hat Satellite 6	Affected	No fix yet: Fix deferred

Timeline

2026-10-23 Threatist record created from CVE-2026-114614
2026-10-23 Affected versions changed · Red Hat
2026-10-23 CVSS score added · Red Hat
2026-10-27 Alias added: GHSA-jj7h-c3hg-m23x
2026-10-29 CISA SSVC decision points changed
2026-10-29 Priority changed: LOW → MEDIUM
2026-10-29 CVSS score added · NVD

References

Other 2

TI-2026-22305 Authlib JWS JWK Header Injection: Signature Verification Bypass CVSS 3.1CRITICAL 9.1
TI-2026-79518 Authlib fix bypass lets attackers forge HS256 tokens with PEM keys CVSS 3.1CRITICAL 9.1
TI-2025-36973 Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) CVSS 3.1HIGH 7.5
TI-2024-25068 lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. CVSS 3.1HIGH 7.5
TI-2025-41738 Authlib: 1-click Account Takeover CVSS 3.1HIGH 8.8
TI-2026-22761 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding CVSS 4.0HIGH 8.2

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences