Executive Summary

This vulnerability exists in the Authlib Python library's OAuth 2.0 authorization endpoint prior to versions 1.6.10 and 1.7.1. When a request uses an unsupported response_type and includes an attacker-controlled redirect_uri, the endpoint can be exploited to perform an unauthenticated open redirect.

The issue occurs before the system performs client lookup or validates the redirect URI, meaning an attacker does not need a valid client registration, an authenticated user, or any prior state to exploit it.

By sending a single crafted request to the authorization endpoint, an attacker can cause the server to respond with a 302 redirect to an arbitrary URL controlled by the attacker.

This vulnerability was fixed in Authlib versions 1.6.10 and 1.7.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to redirect users to malicious websites without authentication or authorization.

Such open redirects can be used in phishing attacks, where users are tricked into visiting attacker-controlled sites that may steal credentials or deliver malware.

Because the redirect happens before any client validation, it can be exploited even if the attacker does not have a valid client registration or user session.

Overall, this can lead to loss of user trust, potential credential compromise, and damage to the reputation of the affected service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Authlib to version 1.6.10 or 1.7.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0