CVE-2026-41479: Authlib OAuth Open Redirect Vulnerability

Technical summary

CVE-2026-41479 is an unauthenticated open redirect vulnerability (CWE-601) in Authlib's OAuth 2.0 authorization endpoint. The vulnerability occurs because redirect URI validation is bypassed when an unsupported response_type parameter is supplied. The vulnerable code path executes before client registration lookup and URI validation logic, allowing an attacker to supply an arbitrary redirect_uri parameter without authentication or a valid client ID. A 302 HTTP response with the attacker-controlled Location header is returned immediately. The vulnerability exists in versions prior to 1.6.10 and 1.7.1.

Business impact

Open redirect vulnerabilities are frequently used as the first step in phishing campaigns, credential harvesting, and social engineering attacks. An attacker can craft a legitimate-looking link that initially points to your OAuth provider but then redirects to a lookalike domain under their control. Users are more likely to trust the redirect since it originated from your authentication system. This erodes customer trust, can damage brand reputation, and may expose sensitive user data if the redirect lands on a credential-stealing page. Organizations using Authlib in production OAuth/OIDC implementations face direct risk to their user base.

Affected systems

This vulnerability affects Authlib versions prior to 1.6.10 (in the 1.6 release line) and prior to 1.7.1 (in the 1.7 release line). Any Python application that uses Authlib to implement OAuth 2.0 or OpenID Connect authorization endpoints is potentially affected if running a vulnerable version. Organizations should audit their Authlib deployments to determine which versions are in use. The vulnerability does not require any special server configuration to be exploitable.

Exploitability

This vulnerability is relatively straightforward to exploit. An attacker needs only to craft a malicious URL pointing to the authorization endpoint with an unsupported response_type and a redirect_uri parameter pointing to their controlled domain. The attack requires user interaction (clicking the link), but the barrier to entry is low—no valid client credentials, no user authentication, and no prior reconnaissance is necessary. The attack surface is the public authorization endpoint itself, making it broadly reachable from the internet in most deployments.

Remediation

Upgrade Authlib immediately to version 1.6.10 or 1.7.1 or later, depending on your current version branch. Before upgrading, verify your current installed version (pip show authlib). Test the patched version in a staging environment to ensure compatibility with your OAuth/OIDC implementation. If upgrading is temporarily blocked, consider implementing additional safeguards such as a Web Application Firewall (WAF) rule that validates redirect_uri parameters against a whitelist of known good domains, though this is not a substitute for patching.

Patch guidance

Update Authlib using pip: `pip install --upgrade authlib>=1.6.10` (for 1.6.x users) or `pip install --upgrade authlib>=1.7.1` (for 1.7.x users). If you maintain a locked dependency file (requirements.txt, Pipfile, or pyproject.toml), update the version constraint and reinstall. After patching, restart your application and any running application instances. Verify the patched version is active by checking the authorization endpoint behavior against the vulnerability description—a request with an unsupported response_type should no longer perform an open redirect. Consult the Authlib GitHub repository and release notes for any breaking changes between your current version and the patched version.

Detection guidance

Monitor authorization endpoint logs for requests containing unusual or unsupported response_type parameters paired with redirect_uri values pointing to external domains. Set up alerts for 302 redirects from your authorization endpoint that point to domains outside your trusted whitelist. Review web server access logs for patterns like multiple requests to /authorize or /oauth/authorize with varying response_type values from the same source IP. Network-based detection could flag requests with response_type values not in your expected set (typically 'code' or 'id_token') combined with external redirect URIs. Consider implementing a WAF rule to block requests where redirect_uri does not match your registered callback domains.

Why prioritize this

Although the CVSS score is MEDIUM (5.4), the vulnerability's lack of authentication requirements, ease of exploitation, and direct impact on user trust make it a high-priority patch. Open redirect flaws are commonly chained with phishing and credential theft. The vulnerability is in a widely-used authentication library, affecting the security posture of all dependent applications. The fix is available and straightforward to deploy, with no reported breaking changes. Patch this promptly to reduce exposure window.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects a network-accessible attack requiring no privileges and minimal complexity, but with low confidentiality and integrity impact and no availability impact. However, CVSS alone does not capture the full risk: the vulnerability's placement in the authentication stack, its use in phishing and social engineering, and its unauthenticated nature elevate practical risk above the base score. The lack of active exploitation in the wild (not yet in CISA KEV) and the availability of patches mitigate some concern, but the ease of exploitation justifies urgent remediation.

Frequently asked questions