CVE-2026-114617

Received Received - Intake

OpenID Connect Nonce Bypass in Authlib

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: GitHub, Inc.

Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-114617

Affected Vendors & Products

Vendor	Product	Version / Range
authlib	authlib	< 1.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

Executive Summary

This vulnerability affects Authlib, a Python library for OAuth and OpenID Connect servers. Before version 1.9.0, a flaw in OpenIDMixin.parse_id_token() allows an attacker to bypass nonce-to-session binding by manipulating the nonce_supported claim in a validly signed token. This enables replay attacks where a victim's token can be used in an attacker-controlled session.

Impact Analysis

If you use Authlib versions before 1.9.0 in implicit or hybrid relying parties, or applications accepting externally supplied ID tokens, an attacker could capture a valid token and replay it to gain unauthorized access to sessions. This could lead to impersonation or data exposure, depending on the application's use case.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Compliance could be impacted if user data is exposed or accessed without authorization due to the replay attack.

Mitigation Strategies

Upgrade Authlib to version 1.9.0 or later to address the vulnerability in OpenIDMixin.parse_id_token().

Hi! I’m here to help you understand CVE-2026-114617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70