CVE-2026-114617

Medium · 4.2

CVSS

4.2

EPSS

0.3%

Published

Oct 22, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A library used by websites to handle logins with third-party accounts can let an attacker reuse someone else's login token in their own browser, potentially taking over accounts.

Chainable

Exploitation: Requires User Interaction
Attacker needs: User Interaction
Complexity: High
Impact: Data Exposure
Component: Library
Class: Authentication Bypass
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

Authlib's OpenIDMixin.parse_id_token() in both sync and async base_client modules trusts the untrusted nonce_supported boolean claim from a captured validly signed ID token; when false it disables the expected nonce check, allowing replay of the token into a different session while still requiring valid signature/issuer/audience.

Why it matters to the business

Organizations using Authlib for OpenID Connect relying-party code in implicit or hybrid flows risk session hijacking and unauthorized access to user accounts if an attacker obtains a valid ID token, increasing exposure for any application that accepts externally supplied tokens.

How an attack unfolds

An attacker captures a validly signed ID token from a victim session, crafts a request to an attacker-controlled session that supplies the same token to parse_id_token(), and because nonce_supported is set to false the library skips nonce binding validation, successfully replaying the token after it passes signature checks.

How to fix it

Upgrade Authlib to version 1.9.0 or later in all environments; applications using only authorization code flow may defer but should still upgrade; do not rely on nonce_supported claims from ID tokens.

How to confirm the fix worked

Confirm the installed Authlib version is 1.9.0+, review application code for direct calls to parse_id_token() or use of implicit/hybrid flows, and test that a token with nonce_supported=false is rejected when nonce binding is expected.

Typical attack path

Obtain a validly signed ID token from a victim via network capture or prior compromise
Initiate an attacker-controlled session against the vulnerable relying party
Supply the captured token to the endpoint that calls parse_id_token()
Trigger nonce_supported=false path to bypass session binding
Gain authenticated access as the victim user

How to detect it

Search application and web-server logs for ID-token parsing events that succeed without a matching session nonce; review any recorded tokens or replay attempts around the time of published disclosure; examine authlib integration modules for nonce handling.

What your security team should do

Immediately inventory all Python services using Authlib and schedule upgrade to 1.9.0 within the next sprint
Audit relying-party code for implicit, hybrid, or direct ID-token acceptance paths and enforce nonce binding server-side
Monitor EPSS trend and re-evaluate if exploit maturity increases given the six-day-old disclosure

The record

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.

Affected packages

Ecosystem	Package	Introduced	Fixed