## Authlib: ID token can disable its own nonce validation via the nonce_supported claim

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-114617
- 公開日時: 2026-10-27T15:39:13.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-c5mf-xmp2-59rc)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-c5mf-xmp2-59rc

影響: pip:authlib <= 1.8.0 → 1.9.0
OpenIDMixin.parse_id_token() reads the nonce_supported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party. The code is…