Bug 2544875 (CVE-2026-104056)

Summary: CVE-2026-104056 authlib: authlib: Information disclosure via unvalidated discovery metadata
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anpicker, anthomas, bparees, dfreiber, dkeler, doconnor, drow, dschmidt, ebourniv, ehelms, ggainey, hasun, ikhan, ilpinto, jburrell, jfula, jlanda, jowilson, jpasqual, juwatts, kshier, ltomasbo, mdellweg, mhayden, mhulan, nmoumoul, nyancey, ometelka, osousa, pcreech, ptisnovs, rbobbitt, rchan, rjohnson, sbunciak, sdoran, simaishi, smallamp, stcannon, suppawar, syedriko, thason, tmalecek, vkumar, xdharmai, yguenane, ykashtan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Authlib. The OpenID Connect (OIDC) and OAuth discovery metadata is cached without validating that returned endpoint addresses match the origin of the configured issuer. A remote attacker who supplies a malicious discovery response can replace legitimate service endpoints with attacker-controlled URLs. This flaw could allow an attacker to intercept sensitive authentication requests and credentials, resulting in information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-01 23:11:54 UTC 
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.