CVE-2026-104056 — CVE-2026-104056
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery re…
Published: 2026-10-01 · CVSS: 9.8 · CVSS 3.1
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7