Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0,
    authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP
    exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host
    is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout
    registration, authorization-server metadata validation, or another call site can bypass the TLS-required
    guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass
    redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable
    authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets
    the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers
    enforce transport security. This issue is fixed in version 1.8.0. (CVE-2026-114614)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0,     authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP     exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host     is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout     registration, authorization-server metadata validation, or another call site can bypass the TLS-required     guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass     redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable     authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets     the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers     enforce transport security. This issue is fixed in version 1.8.0. (CVE-2026-114614)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477858	Chainguard: multiple open-webui packages: security update to 0.12.3-r11	Tenable Cloud Security	Chainguard Local Security Checks	Local	low
477858	Chainguard: multiple open-webui packages: security update to 0.12.3-r11	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	low
477610	SCA: security update for authlib (GHSA-jj7h-c3hg-m23x)	Tenable Cloud Security	SCA Checks	Local	low
477610	SCA: security update for authlib (GHSA-jj7h-c3hg-m23x)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
371301	Linux Distros Unpatched Vulnerability : CVE-2026-114614	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-114614

low

Tenable Plugins

low

low

low

low

low