{"id":"ghsa-ghsa-x4rv-c3wx-4cr8","seq":1708778,"kind":"advisory","title":"Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF","url":"https://github.com/advisories/GHSA-x4rv-c3wx-4cr8","permalink":"https://vulnpulse.app/items/ghsa-ghsa-x4rv-c3wx-4cr8","summary":"影響: pip:authlib >= 1.6.0, < 1.9.0 → 1.9.0\nAuthlib's RFC 9101 (JAR) extension passes the attacker-controlled request_uri authorization parameter straight to the get_request_object() fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this (request_uris client metadata and require_request_uri_registration server metadata) but the extension never consults it, and both docstrings instruct integrators to implement the hook as an unrestricted requests.get(request_uri). D…","severity":"medium","techs":["python"],"cves":["CVE-2026-114620"],"tags":["GHSA-x4rv-c3wx-4cr8","authlib"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:39:18.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}