CVE-2026-41425 Authlib: Cross-site request forging when using cache
Attackers can exploit missing CSRF protection in the cache feature of Authlib's Starlette OAuth client to forge requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41425?
CVE-2026-41425 is a medium-severity vulnerability in authlib, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11.
Weakness: CWE-352
Which versions are affected by CVE-2026-41425?
3 open source packages ship an affected version, including authlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | All versions | 1.6.11 |
authlib PyPI | All versions | 1.6.11 |
authlib PyPI | All versions | 1.6.11 |
Products include Authlib Authlib.
How do I fix CVE-2026-41425?
Upgrade authlib to 1.6.11 or later.
Is CVE-2026-41425 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41425 exists.
Other vulnerabilities in authlib
- CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Sources
Also known as CLEANSTART-2026-PH07803, CLEANSTART-2026-TK51570, DEBIAN-CVE-2026-41425, ECHO-7bae-4322-bdc1, GHSA-jj8c-mmj3-mmgv, MINI-c9pr-hvgq-7mc4 and 5 more.