Bug 2559396 (CVE-2026-114619)

Summary:	CVE-2026-114619 authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anpicker, anthomas, dfreiber, dkeler, doconnor, drow, dschmidt, ebourniv, ehelms, ggainey, hasun, ilpinto, jburrell, jfula, jlanda, jowilson, jpasqual, juwatts, kshier, ltomasbo, mdellweg, mhayden, mhulan, nmoumoul, nyancey, ometelka, osousa, pcreech, ptisnovs, rbobbitt, rchan, rjohnson, sbunciak, sdoran, simaishi, smallamp, stcannon, suppawar, syedriko, thason, tmalecek, vkumar, xdharmai, yguenane, ykashtan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Authlib. This vulnerability allows an authenticated client to bypass authorization scope restrictions and obtain an unauthorized OpenID Connect (OIDC) identity token, leading to information disclosure. During an implicit grant authorization request, the application evaluates the raw client-provided scope parameter rather than the filtered list of permitted scopes. Consequently, a client not authorized for the 'openid' scope can request user consent and receive a signed ID token containing the user's identity and profile claims.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-22 21:41:41 UTC

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client permitted an ID token response type but not the openid scope can add openid to the request, obtain user consent, and receive a signed ID token containing the user's subject and allowed profile claims. Authorization code flow and deployments that allow openid for every client permitted an ID token response are not affected. In authlib/oidc/core/grants/implicit.py, OpenIDImplicitGrant.validate_authorization_request() checks request.payload.scope instead of the filtered request.scope. This issue is fixed in version 1.9.0.