https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:47:12 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-14994 bdu:2026-14994 https://cve.radiocsirt.org/vuln/bdu:2026-14994 https://cve.radiocsirt.org/vuln/brew-fastmcp-cve-2026-41479 <p><strong>Affected:</strong> Homebrew: fastmcp</p> <p>### Summary Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri.</p> <p>The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL.</p> <p>It was confirmed that the vulnerable code is present in tag v1.6.6 and in the current HEAD under test (68e6ab3fdfc71a328b1966bad5c6aba0f7d0c2e1, git describe: v1.6.6-104-g68e6ab3f). The issue was dynamically reproduced locally on the current HEAD.</p> <p>### Details The root cause is that `AuthorizationServer.get_authorization_grant()` copies the raw request `redirect_uri` into an `UnsupportedResponseTypeError` before any client has been resolved and before any redirect URI validation has happened:</p> <p>```python # authlib/oauth2/rfc6749/authorization_server.py raise UnsupportedResponseTypeError( f&#34;The response type &#39;{request.payload.response_type}&#39; is not supported by the server.&#34;, request.payload.response_type, redirect_uri=request.payload.redirect_uri, )</p> <p>That error object is later rendered by OAuth2Error.__call__(). If redirect_uri is set, Authlib automatically returns a redirect response to that URI:</p> <p># authlib…</p> <p><strong>Affected:</strong> Homebrew: fastmcp</p> <p>### Summary Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri.</p> <p>The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL.</p> <p>It was confirmed that the vulnerable code is present in tag v1.6.6 and in the current HEAD under test (68e6ab3fdfc71a328b1966bad5c6aba0f7d0c2e1, git describe: v1.6.6-104-g68e6ab3f). The issue was dynamically reproduced locally on the current HEAD.</p> <p>### Details The root cause is that `AuthorizationServer.get_authorization_grant()` copies the raw request `redirect_uri` into an `UnsupportedResponseTypeError` before any client has been resolved and before any redirect URI validation has happened:</p> <p>```python # authlib/oauth2/rfc6749/authorization_server.py raise UnsupportedResponseTypeError( f&#34;The response type &#39;{request.payload.response_type}&#39; is not supported by the server.&#34;, request.payload.response_type, redirect_uri=request.payload.redirect_uri, )</p> <p>That error object is later rendered by OAuth2Error.__call__(). If redirect_uri is set, Authlib automatically returns a redirect response to that URI:</p> <p># authlib…</p> https://cve.radiocsirt.org/vuln/brew-fastmcp-cve-2026-41479 https://cve.radiocsirt.org/vuln/euvd-2026-329298 EUVD-2026-329298 https://cve.radiocsirt.org/vuln/euvd-2026-329298 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41479 <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL. This vulnerability is fixed in 1.6.10 and 1.7.1.</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL. This vulnerability is fixed in 1.6.10 and 1.7.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41479 https://cve.radiocsirt.org/vuln/ghsa-w8p2-r796-3vmq <p><strong>Affected:</strong> PyPI: authlib</p> <p>### Summary Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri.</p> <p>The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL.</p> <p>It was confirmed that the vulnerable code is present in tag v1.6.6 and in the current HEAD under test (68e6ab3fdfc71a328b1966bad5c6aba0f7d0c2e1, git describe: v1.6.6-104-g68e6ab3f). The issue was dynamically reproduced locally on the current HEAD.</p> <p>### Details The root cause is that `AuthorizationServer.get_authorization_grant()` copies the raw request `redirect_uri` into an `UnsupportedResponseTypeError` before any client has been resolved and before any redirect URI validation has happened:</p> <p>```python # authlib/oauth2/rfc6749/authorization_server.py raise UnsupportedResponseTypeError( f&#34;The response type &#39;{request.payload.response_type}&#39; is not supported by the server.&#34;, request.payload.response_type, redirect_uri=request.payload.redirect_uri, )</p> <p>That error object is later rendered by OAuth2Error.__call__(). If redirect_uri is set, Authlib automatically returns a redirect response to that URI:</p> <p># authlib…</p> <p><strong>Affected:</strong> PyPI: authlib</p> <p>### Summary Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri.</p> <p>The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL.</p> <p>It was confirmed that the vulnerable code is present in tag v1.6.6 and in the current HEAD under test (68e6ab3fdfc71a328b1966bad5c6aba0f7d0c2e1, git describe: v1.6.6-104-g68e6ab3f). The issue was dynamically reproduced locally on the current HEAD.</p> <p>### Details The root cause is that `AuthorizationServer.get_authorization_grant()` copies the raw request `redirect_uri` into an `UnsupportedResponseTypeError` before any client has been resolved and before any redirect URI validation has happened:</p> <p>```python # authlib/oauth2/rfc6749/authorization_server.py raise UnsupportedResponseTypeError( f&#34;The response type &#39;{request.payload.response_type}&#39; is not supported by the server.&#34;, request.payload.response_type, redirect_uri=request.payload.redirect_uri, )</p> <p>That error object is later rendered by OAuth2Error.__call__(). If redirect_uri is set, Authlib automatically returns a redirect response to that URI:</p> <p># authlib…</p> https://cve.radiocsirt.org/vuln/ghsa-w8p2-r796-3vmq https://cve.radiocsirt.org/vuln/opensuse-su-2026:21795-1 <p>Security update for python-Authlib</p> <p>Security update for python-Authlib</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21795-1 https://cve.radiocsirt.org/vuln/pysec-2026-2119 <p><strong>Affected:</strong> PyPI: authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL. This vulnerability is fixed in 1.6.10 and 1.7.1.</p> <p><strong>Affected:</strong> PyPI: authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL. This vulnerability is fixed in 1.6.10 and 1.7.1.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2119 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41479 <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: python-authlib, Ubuntu:Pro:24.04:LTS: python-authlib, Ubuntu:25.10: python-authlib, Ubuntu:Pro:26.04:LTS: python-authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL. This vulnerability is fixed in 1.6.10 and 1.7.1.</p> <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: python-authlib, Ubuntu:Pro:24.04:LTS: python-authlib, Ubuntu:25.10: python-authlib, Ubuntu:Pro:26.04:LTS: python-authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib&#39;s OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an unsupported response_type and supplies an attacker-controlled redirect_uri. The vulnerable behavior happens before client lookup and before any redirect URI validation. As a result, an attacker does not need a valid client registration, an authenticated user, or any prior state. A single request to the authorization endpoint is enough to obtain a 302 Location response to an arbitrary attacker-controlled URL. This vulnerability is fixed in 1.6.10 and 1.7.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41479