Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

影響: pip:authlib >= 1.6.0, < 1.9.0 → 1.9.0

Authlib's RFC 9101 (JAR) extension passes the attacker-controlled request_uri authorization parameter straight to the get_request_object() fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this (request_uris client metadata and require_request_uri_registration server metadata) but the extension never consults it, and both docstrings instruct integrators to implement the hook as an unrestricted requests.get(request_uri). D…

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 12:39, GitHub Advisory Database에서 "Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-114620.