Authlib: ID token can disable its own nonce validation via the nonce_supported claim

影響: pip:authlib <= 1.8.0 → 1.9.0

OpenIDMixin.parse_id_token() reads the nonce_supported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party. The code is…

Read on GitHub Advisory Database

On 10/28/2026, 12:39 AM, GitHub Advisory Database published "Authlib: ID token can disable its own nonce validation via the nonce_supported claim" (type: Advisory). Severity is "Medium" (medium). Related technologies: Python. CVE: CVE-2026-114617.