CVE-2025-68158
Medium · 5.7CVSS
5.7
EPSS
0.3%
Published
Jan 8, 2026
CISA due date
—
The record
Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | authlib | 0 | 1.6.6 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python-Authlib | 0 | 1.3.1-150600.3.14.1 |
| openSUSE:Leap 15.6 | python-Authlib | 0 | 1.3.1-150600.3.14.1 |
| openSUSE:Leap 16.0 | python-Authlib | 0 | 1.5.2-bp160.2.1 |
| openSUSE:Tumbleweed | python-Authlib | 0 | 1.6.6-1.1 |
Related vulnerabilities
- GHSA-fg6f-75jq-6523 Authlib has 1-click Account Takeover vulnerability Same vulnerability
- CVE-2026-28802 Authlib is a Python library which builds OAuth and OpenID Connect servers. Also affects authlib
- CVE-2025-62706 Authlib : JWE zip=DEF decompression bomb enables DoS Also affects authlib
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments Also affects authlib
- CVE-2025-59420 Authlib is a Python library which builds OAuth and OpenID Connect servers. Also affects authlib
- CVE-2026-27962 Authlib is a Python library which builds OAuth and OpenID Connect servers. Also affects python-Authlib
- CVE-2026-28490 Authlib is a Python library which builds OAuth and OpenID Connect servers. Also affects python-Authlib
- CVE-2026-28498 Authlib is a Python library which builds OAuth and OpenID Connect servers. Also affects python-Authlib