{"id":"ghsa-ghsa-jj7h-c3hg-m23x","seq":1708788,"kind":"advisory","title":"Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts","url":"https://github.com/advisories/GHSA-jj7h-c3hg-m23x","permalink":"https://vulnpulse.app/items/ghsa-ghsa-jj7h-c3hg-m23x","summary":"影響: pip:authlib <= 1.7.2 → 1.8.0\nauthlib.common.security.is_secure_transport() is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL such as http://localhost:80@evil.example/cb — whose actual host is evil.example and whose scheme is plain http — is accepted as \"secure\". An attacker who can supply a URL to any of the sinks that rely on th…","severity":"low","techs":["python"],"cves":["CVE-2026-114614"],"tags":["GHSA-jj7h-c3hg-m23x","authlib"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:37:48.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}