Authlib: ID token can disable its own nonce validation via the nonce_supported claim

影響: pip:authlib <= 1.8.0 → 1.9.0

OpenIDMixin.parse_id_token() reads the nonce_supported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party. The code is…

GitHub Advisory Databaseで読む

2026/10/28 00:39、GitHub Advisory Databaseが「Authlib: ID token can disable its own nonce validation via the nonce_supported claim」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-114617。