6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44681

CVE-2026-44681: Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorization

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44681

CVE-2026-44681:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
authlib	pip	= 1.7.0	1.7.1
authlib	pip	<= 1.6.11	1.6.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the OpenIDImplicitGrant and OpenIDHybridGrant classes within the authlib library. Specifically, the validate_authorization_request methods in both grants perform a check for the 'openid' scope before validating the redirect_uri provided in the authorization request. If the 'openid' scope is missing, the code raises an InvalidScopeError and includes the unvalidated redirect_uri from the request. The OAuth2Error handling mechanism then constructs a 302 redirect response to this unvalidated URI, resulting in an open redirect. An attacker can exploit this by crafting a request that omits the 'openid' scope and provides a malicious redirect_uri, causing the authorization server to redirect the user to an attacker-controlled site. The patch corrects this by ensuring that the redirect_uri is validated before the scope check is performed, so that any subsequent error-related redirects use a trusted URI.

Vulnerable functions

OpenIDHybridGrant.validate_authorization_request

authlib/oidc/core/grants/hybrid.py

The function raises an `InvalidScopeError` with an unvalidated `redirect_uri` from the request payload if the 'openid' scope is missing. This occurs before the `redirect_uri` is validated, leading to an open redirect vulnerability. The patch reorders the operations to validate the `redirect_uri` before checking for the 'openid' scope.

OpenIDImplicitGrant.validate_authorization_request

authlib/oidc/core/grants/implicit.py

The function raises an `InvalidScopeError` with an unvalidated `redirect_uri` from the request payload if the 'openid' scope is missing. This happens before the call to `super().validate_authorization_request()`, which is responsible for validating the `redirect_uri`. This allows an attacker to specify a malicious redirect target. The patch fixes this by calling the parent's validation method first.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.