{"id":"ghsa-ghsa-q686-2qmg-hqc7","seq":1708781,"kind":"advisory","title":"Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens","url":"https://github.com/advisories/GHSA-q686-2qmg-hqc7","permalink":"https://vulnpulse.app/items/ghsa-ghsa-q686-2qmg-hqc7","summary":"影響: pip:authlib < 1.9.0 → 1.9.0\nReport metadata | Field | Value | | --- | --- | | Package | authlib (PyPI, pkg:pypi/authlib) | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validate_authorization_request | | Vulnerability class | Authorization bypass: a client's scope restriction is bypassed for OpenID Connect ID token issuance | | Verified against | c529a61af40e3efe05286140e00fbdced07d7987 (v1.8.0). Earlier releases were not checked. | | API surface |…","severity":"medium","techs":["python"],"cves":["CVE-2026-114619"],"tags":["GHSA-q686-2qmg-hqc7","authlib"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:38:53.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}