Authlib: ID token can disable its own nonce validation via the nonce_supported claim

影響: pip:authlib <= 1.8.0 → 1.9.0

OpenIDMixin.parse_id_token() reads the nonce_supported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party. The code is…

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 12:39, GitHub Advisory Database에서 "Authlib: ID token can disable its own nonce validation via the nonce_supported claim"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-114617.