Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user's subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0,
    OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw
    request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A
    registered client permitted an ID token response type but not the openid scope can add openid to the
    request, obtain user consent, and receive a signed ID token containing the user's subject and allowed
    profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID
    token response are not affected. In authlib/oidc/core/grants/implicit.py,
    OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered
    request.scope. This issue is fixed in version 1.9.0. (CVE-2026-114619)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0,     OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw     request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A     registered client permitted an ID token response type but not the openid scope can add openid to the     request, obtain user consent, and receive a signed ID token containing the user's subject and allowed     profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID     token response are not affected. In authlib/oidc/core/grants/implicit.py,     OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered     request.scope. This issue is fixed in version 1.9.0. (CVE-2026-114619)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477753	Chainguard: py3.12-airflow-3: security update to 3.3.2-r11	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
477753	Chainguard: py3.12-airflow-3: security update to 3.3.2-r11	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
477608	SCA: security update for authlib (GHSA-q686-2qmg-hqc7)	Tenable Cloud Security	SCA Checks	Local	medium
477608	SCA: security update for authlib (GHSA-q686-2qmg-hqc7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
371340	Linux Distros Unpatched Vulnerability : CVE-2026-114619	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-114619

medium

Tenable Plugins

medium

medium

medium

medium

medium