Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4708 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4708-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     July 31, 2026                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : python-authlib     Version        : 0.15.4-1+deb11u4 1.2.0-1+deb12u2     CVE ID         : CVE-2026-27962 CVE-2026-28490 CVE-2026-28498 CVE-2026-41425                      CVE-2026-44681

    The following security issue has been identified (and fixed) in python-authlib     as shipped in Debian bullseye and Debian bookworm.

    CVE-2026-44681

        An unauthenticated open redirect in Authlib's OpenIDImplicitGrant         and OpenIDHybridGrant authorisation endpoint allowed a remote         attacker to cause the authorisation server to issue an HTTP 302 to         an attacker-chosen URL by submitting an authorisation request that         omits the openid scope.

    For Debian 11 bullseye, this problem has been fixed in version     0.15.4-1+deb11u4.

    In addition, the following issues have been fixed in the python-authlib version     as shipped in Debian bookworm:

    CVE-2026-27962

        Fix authentication and authorization bypass vulnerability by embedding a         crafted public key in the jwk header field when key=None is passed to JWS         deserialisation functions.

    CVE-2026-28490

        Authlib exposed distinguishable error responses between invalid PKCS#1 v1.5         padding and invalid AES-GCM tag, enabling Bleichenbacher-style attacks.

    CVE-2026-28498

        Fix OIDC ID Token validation bypass in at_hash and c_hash verification.
        _verify_hash() silently returned True when create_half_hash() received an         unknown algorithm, allowing forged ID Tokens to pass validation.

    CVE-2026-41425

        CSRF protection now covers the cache feature in         authlib.integrations.starlette_client.OAuth as well.

    For Debian 12 bookworm, these problems have been fixed in version     1.2.0-1+deb12u2.

    We recommend that you upgrade your python-authlib packages.

    For the detailed security status of python-authlib please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-authlib

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8557-1 advisory.

    Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded     in JWT headers. An attacker could possibly use this issue to forge trusted tokens, resulting in     authentication and authorization bypass. (CVE-2026-27962)

    Jay Neiva and Mauro Carrillo discovered that Authlib incorrectly handled RSA1_5 encrypted tokens. An     attacker could possibly use this issue to recover sensitive encrypted information, resulting in     information disclosure. (CVE-2026-28490)

    Jay Neiva and Mauro Carrillo discovered that Authlib did not properly reject unsupported cryptographic     algorithms when validating OpenID Connect ID tokens. An attacker could possibly use this issue to bypass     token integrity checks, resulting in authentication bypass. (CVE-2026-28498)

    Johnny Deuss discovered that Authlib did not provide cross-site request forgery protection for the OAuth     cache feature in its Starlette integration. An attacker could possibly use this issue to perform     unauthorized OAuth actions, resulting in cross-site request forgery. This issue only affected Ubuntu 24.04     LTS and Ubuntu 26.04 LTS. (CVE-2026-41425)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2968-1 advisory.

    This update for python-Authlib fixes the following issues

    - CVE-2026-41425: Prior to 1.6.11, there is no CSRF protection on the cache feature in       authlib.integrations.starlette_client.OAuth (bsc#1263114).
    - CVE-2026-44681: Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's     OpenIDImplicitGrant and       OpenIDHybridGrant authorization endpoint exists (bsc#1266665).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no
    CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is
    fixed in 1.6.11. (CVE-2026-41425)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no     CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is     fixed in 1.6.11. (CVE-2026-41425)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
331518	Debian dla-4708 : python-authlib-doc - security update	Nessus	Debian Local Security Checks	Local	high
327649	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Authlib vulnerabilities (USN-8557-1)	Nessus	Ubuntu Local Security Checks	Local	high
326967	SUSE SLED15 / SLES15 Security Update : python-Authlib (SUSE-SU-2026:2968-1)	Nessus	SuSE Local Security Checks	Local	medium
440916	SCA: security update for authlib (GHSA-jj8c-mmj3-mmgv)	Tenable Cloud Security	SCA Checks	Local	medium
440916	SCA: security update for authlib (GHSA-jj8c-mmj3-mmgv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
310286	Linux Distros Unpatched Vulnerability : CVE-2026-41425	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-41425

medium

Tenable Plugins

high

high

medium

medium

medium

medium