CVE-2026-114614

What it actually does

The is_secure_transport() function in authlib/common/security.py performs a textual prefix match on the userinfo component of a URL to decide loopback exemptions instead of inspecting the parsed host, allowing a crafted URL with an external host to be treated as loopback and accepted without TLS enforcement.

Why it matters to the business

Organizations using Authlib for OAuth or OpenID Connect servers face a narrow risk of cleartext URL handling in logout or metadata flows, which could expose redirect data in transit; the low likelihood and limited impact mean operational disruption is minimal but still requires prompt patching to maintain transport security guarantees.

How an attack unfolds

An attacker supplies a malicious URL containing a loopback-looking userinfo prefix to an OIDC RP-Initiated Logout registration or authorization-server metadata validation endpoint; because the flawed prefix check passes, the library accepts the URL without requiring TLS, resulting in cleartext redirection or acceptance while still respecting exact redirect URI matching.

How to fix it

Upgrade Authlib to version 1.8.0 or later, which corrects the is_secure_transport() implementation; until the upgrade is complete, review all call sites that rely on is_secure_transport() and enforce explicit TLS checks or restrict URL inputs to trusted sources.

How to confirm the fix worked

After upgrade, confirm the new version string appears in the installed package metadata, then exercise the previously vulnerable URL patterns against is_secure_transport() and verify that only true loopback hosts (after proper parsing) are exempted from TLS requirements.

Typical attack path

1. Identify an Authlib-based OIDC relying party or authorization server that accepts dynamic client registration or metadata URLs.
2. Craft a URL whose userinfo begins with a loopback address but whose host component points to an attacker-controlled non-loopback system.
3. Submit the URL to the affected endpoint (e.g., RP-Initiated Logout or metadata validation).
4. Observe acceptance of the URL without TLS enforcement, enabling cleartext communication for that specific flow.

How to detect it

Review application logs for calls to is_secure_transport() that accept URLs containing userinfo prefixes resembling loopback addresses; examine any OIDC registration or metadata endpoints for incoming URLs that were processed without TLS enforcement.

What your security team should do

• Prioritize upgrade to Authlib 1.8.0 across all OAuth/OpenID Connect deployments within the next 30 days given the recent publication.
• Audit code and configuration that passes user-supplied URLs to Authlib metadata or logout handlers.
• Add runtime logging around is_secure_transport() decisions until the patched version is deployed.
• Monitor EPSS and exploit maturity indicators; no active exploitation has been observed to date.