CVE-2026-116672 Authlib RFC 7592 examples omit registration-access-token client binding
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116672?
CVE-2026-116672 is a high-severity vulnerability in authlib, published on 27 Oct 2026.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.
Which versions are affected by CVE-2026-116672?
How do I fix CVE-2026-116672?
No fix has been published for CVE-2026-116672 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116672 being exploited?
There is no known exploitation of CVE-2026-116672 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116672, GHSA-c73q-w75p-j82v, UBUNTU-CVE-2026-116672.