CVE-2026-114620 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

What is CVE-2026-114620?

CVE-2026-114620 is a medium-severity vulnerability in authlib, published on 22 Oct 2026.

Official description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0.

Weakness: CWE-918

Which versions are affected by CVE-2026-114620?

2 open source packages ship an affected version, including authlib. It affects 1 product.

Products include Authlib Authlib.

How do I fix CVE-2026-114620?

Upgrade authlib to 1.9.0 or later.

Is CVE-2026-114620 being exploited?

There is no known exploitation of CVE-2026-114620 in the wild and no public exploit code.

Other vulnerabilities in authlib

• CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass Critical 9.1
• CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle High 8.3
• CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding High 8.2
• CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification High 7.7
• CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-114620, ECHO-567b-5cd2-78a6, GHSA-x4rv-c3wx-4cr8, MINI-jrqr-f4v2-r686, UBUNTU-CVE-2026-114620.