Authlib: ID token can disable its own nonce validation via the nonce_supported claim

影響: pip:authlib <= 1.8.0 → 1.9.0

OpenIDMixin.parse_id_token() reads the nonce_supported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party. The code is…

在 GitHub Advisory Database 阅读

2026/10/28 00:39，GitHub Advisory Database 发布了“Authlib: ID token can disable its own nonce validation via the nonce_supported claim”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-114617。