Read the docs
TI-2026-81427 Aliases CVE-2026-116672GHSA-c73q-w75p-j82v

Authlib RFC 7592 examples allow changing other clients' registrations

Priority MEDIUM 40CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-639.

Summary

Authlib from 0.15 before 1.9.1 has an authorization bypass in the documented ClientConfigurationEndpoint.authenticate_client example. It trusts a request-supplied client_id and does not check that the registration access token belongs to that client. An attacker with any valid registration access token can read, modify or delete another client's registration. Changing redirect_uris can enable authorization code or token interception.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-07
Fix Partial authlib (authlib): 1.9.1Authlib (PyPI): 1.9.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
authlibauthlib0.15 to before 1.9.11.9.1Patch availableCNA
—Authlib (PyPI)0.15 to before 1.9.11.9.1Patch availableGHSA-c73q-w75p-j82v
  • authlib Vendorauthlib Affected 0.15 to before 1.9.1 Fixed in 1.9.1 Patch available CNA
  • Authlib (PyPI) Vendor— Affected 0.15 to before 1.9.1 Fixed in 1.9.1 Patch available GHSA-c73q-w75p-j82v

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*——authlib
  • cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:* Versions — — ·authlib

Remediation

Upgrade Authlib to 1.9.1, the fixed version for the authlib and PyPI Authlib packages. Red Hat fixes Red Hat Satellite 6.18 and 6.19 in RHSA-2026:92667 and RHSA-2026:92666. Red Hat has no fix for Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8 and other products, and no fix is planned for OpenShift Lightspeed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA authlib (authlib) Fixed in 1.9.1
  • Fix · GHSA-c73q-w75p-j82v Authlib (PyPI) Fixed in 1.9.1 Advisory →

Red Hat 2 advisories

  • RHSA-2026:92667 Released 2026-10-29 · Red Hat rating Critical
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:92666 Released 2026-10-29 · Red Hat rating Critical
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/foreman-mcp-server-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet
Lightspeed CoreAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
OpenShift LightspeedAffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Satellite 6.18Fixed RHSA-2026:92667
Red Hat Satellite 6.19Fixed RHSA-2026:92666
Not affected: 1 product
  • Red Hat Enterprise Linux command line assistant

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-116672
  2. 2026-10-28 Priority changed: MEDIUM → LOW
  3. 2026-10-29 Affected versions changed · Red Hat
  4. 2026-10-29 CVSS score added · Red Hat
  5. 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19 · Red Hat
  6. 2026-10-30 CISA SSVC decision points changed
  7. 2026-10-30 Priority changed: LOW → MEDIUM
  8. 2026-10-30 Alias added: GHSA-c73q-w75p-j82v
  9. 2026-10-30 Fix available: PyPI/[email protected] · GHSA-c73q-w75p-j82v
  10. 2026-10-30 CVSS score added · GHSA-c73q-w75p-j82v
  11. 2026-10-30 Weakness changed · GHSA-c73q-w75p-j82v
  12. 2026-10-30 5 new references · GHSA-c73q-w75p-j82v
  13. 2026-10-31 Fix available: RHSA-2026:92666 · Red Hat
  14. 2026-10-31 Fix available: RHSA-2026:92667 · Red Hat
  15. 2026-11-02 Affected versions changed · Red Hat
  16. 2026-11-04 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2026-65772 Insufficient verification of data authenticity in Authlib CVSS 3.1CRITICAL 9.8
  • TI-2026-74876 Signature verification bypass in joserfc JWS deserialization CVSS 3.1CRITICAL 9.1
  • TI-2026-22305 Authlib JWS JWK Header Injection: Signature Verification Bypass CVSS 3.1CRITICAL 9.1
  • TI-2025-40202 Resource allocation without limits in authlib joserfc CVSS 4.0CRITICAL 9.2
  • TI-2026-36756 joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVSS 4.0HIGH 8.7
  • TI-2026-79518 Authlib fix bypass lets attackers forge HS256 tokens with PEM keys CVSS 3.1CRITICAL 9.1
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences