CVE-2026-104056 CVE-2026-104056
Attackers can poison cached discovery metadata to redirect authentication endpoints, bypassing origin validation in Authlib.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104056?
CVE-2026-104056 is a critical vulnerability in Authlib, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
Which versions are affected by CVE-2026-104056?
How do I fix CVE-2026-104056?
No fix has been published for CVE-2026-104056 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104056 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104056 exists.
Sources
Also known as DEBIAN-CVE-2026-104056, GHSA-8wx9-759m-hfm8, UBUNTU-CVE-2026-104056.