CVE-2026-104056

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-01

Last updated on: 2026-10-05

Assigner: CERT/CC

Description

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-01

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104056

EUVD

EUVD-2026-91003

Affected Vendors & Products

Vendor	Product	Version / Range
Authlib	Authlib	1.7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

Authlib versions 1.7.2 and below have a flaw where discovery JSON metadata is cached without proper validation or issuer-origin binding. This means an attacker could manipulate the discovery response to replace legitimate endpoint URLs with attacker-controlled values, even if those values do not share the same origin as the configured server metadata URL.

Impact Analysis

This vulnerability could allow attackers to redirect authentication flows to malicious endpoints, potentially leading to unauthorized access to user accounts or sensitive data. It undermines the security of OAuth/OpenID Connect implementations using affected Authlib versions.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Attackers may exploit the cached metadata to redirect endpoints to malicious servers, compromising compliance with these regulations.

Mitigation Strategies

Upgrade Authlib to a version higher than 1.7.2 where the discovery JSON metadata caching issue has been fixed. Review cached discovery responses for any unauthorized modifications and ensure issuer-origin binding is enforced in the configuration.

Hi! I’m here to help you understand CVE-2026-104056. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70