CVE-2026-44681 Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization
An unauthenticated open redirect in Authlib's OIDC authorization endpoint allows attackers to redirect users to malicious URLs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44681?
CVE-2026-44681 is a medium-severity vulnerability in authlib, published on 27 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.
Which versions are affected by CVE-2026-44681?
5 open source packages ship an affected version, including authlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | All versions | 1.6.12 |
authlib PyPI | All versions | 1.6.12 |
authlib PyPI | All versions | 1.6.12 |
authlib PyPI | From 1.7.0 | 1.7.1 |
authlib PyPI | From 1.7.0 | 1.7.1 |
Linux distribution packages (1)
python-Authlib openSUSE:Tumbleweed | All versions | 1.7.2-1.1 |
Products include Authlib Authlib.
How do I fix CVE-2026-44681?
Upgrade authlib to a fixed version for your release line: 1.6.12 or 1.7.1.
Is CVE-2026-44681 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44681 exists.
Other vulnerabilities in authlib
- CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Sources
Also known as CLEANSTART-2026-HL24999, CLEANSTART-2026-UZ98242, DEBIAN-CVE-2026-44681, ECHO-abd9-179e-e8ab, GHSA-r95x-qfjj-fjj2, MINI-pgrm-6cg6-9cp7 and 5 more.