CVE-2026-104056: Authlib

Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.

Affected products

• Authlib Authlib: version 1.7.2 only

Published 2026-10-01. Last modified 2026-10-05.