Bug 2559397 (CVE-2026-114617)

Summary:	CVE-2026-114617 authlib: Authlib: Authentication bypass via disabled nonce verification in OpenID Connect tokens
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anpicker, anthomas, dfreiber, dkeler, doconnor, drow, dschmidt, ebourniv, ehelms, ggainey, hasun, ilpinto, jburrell, jfula, jlanda, jowilson, jpasqual, juwatts, kshier, ltomasbo, mdellweg, mhayden, mhulan, nmoumoul, nyancey, ometelka, osousa, pcreech, ptisnovs, rbobbitt, rchan, rjohnson, sbunciak, sdoran, simaishi, smallamp, stcannon, suppawar, syedriko, thason, tmalecek, vkumar, xdharmai, yguenane, ykashtan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Authlib. When validating OpenID Connect (OIDC) identity tokens, the library improperly relies on a claim within the incoming token to decide whether to enforce nonce verification, which binds the token to an active session. A remote attacker with a captured, validly signed token can exploit this flaw to bypass session validation and replay the victim's token into an attacker-controlled session, resulting in unauthorized account impersonation.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-22 21:41:51 UTC

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.