Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
影響: pip:authlib < 1.9.0 → 1.9.0
Report metadata | Field | Value | | --- | --- | | Package | authlib (PyPI, pkg:pypi/authlib) | | Repository | https://github.com/authlib/authlib | | Component | authlib.oidc.core.grants.implicit.OpenIDImplicitGrant.validate_authorization_request | | Vulnerability class | Authorization bypass: a client's scope restriction is bypassed for OpenID Connect ID token issuance | | Verified against | c529a61af40e3efe05286140e00fbdced07d7987 (v1.8.0). Earlier releases were not checked. | | API surface |…
| CVE | CVE-2026-114619 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 12:38, GitHub Advisory Database에서 "Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-114619.