CVE-2026-114619 Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114619?
CVE-2026-114619 is a medium-severity vulnerability in authlib, published on 22 Oct 2026.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user's subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-114619?
2 open source packages ship an affected version, including authlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | All versions | 1.9.0 |
authlib PyPI | All versions | 1.9.0 |
Products include Authlib Authlib.
How do I fix CVE-2026-114619?
Upgrade authlib to 1.9.0 or later.
Is CVE-2026-114619 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114619 exists.
Other vulnerabilities in authlib
- CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Sources
Also known as DEBIAN-CVE-2026-114619, ECHO-72c7-353f-8dfa, GHSA-q686-2qmg-hqc7, MINI-9688-r4gw-33cc, UBUNTU-CVE-2026-114619.