5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68158

CVE-2025-68158: Authlib: 1-click Account Takeover

Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under state{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68158

CVE-2025-68158:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
authlib	pip	<= 1.6.5	1.6.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) in Authlib's OAuth integration, specifically when a cache is used for storing the 'state' parameter. The root cause is that the state was not tied to the user's session. The function FrameworkIntegration.get_state_data would retrieve state information from a shared cache using a key that an attacker could predict and provide to a victim. The victim's browser, while logged into an application, would then use the attacker's state to complete an OAuth flow. The authorize_access_token function in flask_client would call the vulnerable get_state_data, receive the attacker's data, and proceed to link the attacker's external identity with the victim's application account. The patch addresses this by modifying set_state_data to create a marker in the user's session and updating get_state_data to verify this marker's existence before trusting the data from the cache, effectively binding the OAuth state to the user's session.

Vulnerable functions

FrameworkIntegration.get_state_data

authlib/integrations/base_client/framework_integration.py

This function was vulnerable because when a cache was configured, it retrieved OAuth state data using a key that was not tied to the user's session. An attacker could initiate an OAuth flow to obtain a valid 'state', then trick a victim into completing the flow with the attacker's 'state'. This function would then incorrectly fetch the attacker's state data from the cache, leading to a Cross-Site Request Forgery (CSRF) vulnerability that could result in account takeover. The fix ensures that a corresponding state key exists in the user's session before attempting to retrieve data from the cache.

FrameworkIntegration.set_state_data

authlib/integrations/base_client/framework_integration.py

This function contributed to the vulnerability by storing OAuth state data in the cache without creating a corresponding record in the user's session. This omission allowed the vulnerable 'get_state_data' function to be exploited. The fix modifies this function to also store a marker in the user's session, which is then checked by the patched 'get_state_data' to verify the session's ownership of the state.

RemoteApp.authorize_access_token

authlib/integrations/flask_client/apps.py

This function is a key component in the exploit chain as it calls the vulnerable 'get_state_data' function. It retrieves the 'state' from the incoming request and uses it to fetch the associated request token. Because 'get_state_data' was not session-bound, 'authorize_access_token' would proceed with the token exchange using state data from an attacker's session, ultimately leading to an account takeover. This function would appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.