CVE-2026-41479 Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-41479?
CVE-2026-41479 is a medium-severity vulnerability in authlib, published on 22 Jun 2026.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL. This vulnerability is fixed in 1.6.10 and 1.7.1.
Weakness: CWE-601
Which versions are affected by CVE-2026-41479?
5 open source packages ship an affected version, including authlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | All versions | 1.6.10 |
authlib PyPI | All versions | 1.6.10 |
authlib PyPI | All versions | 1.6.10 |
authlib PyPI | From 1.7.0 | 1.7.1 |
authlib PyPI | From 1.7.0 | 1.7.1 |
Linux distribution packages (2)
python-Authlib SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 1.3.1-150600.3.30.1 |
python-Authlib openSUSE:Leap 16.0 | All versions | 1.5.2-bp160.4.1 |
Products include Authlib Authlib.
How do I fix CVE-2026-41479?
Upgrade authlib to a fixed version for your release line: 1.6.10 or 1.7.1.
Is CVE-2026-41479 being exploited?
There is no known exploitation of CVE-2026-41479 in the wild and no public exploit code.
Other vulnerabilities in authlib
- CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Sources
Also known as DEBIAN-CVE-2026-41479, ECHO-c358-1d0d-d3a2, GHSA-w8p2-r796-3vmq, MINI-p297-6w5v-99r9, MINI-v75p-c3rc-gqf7, PYSEC-2026-2119 and 4 more.