CVE-2026-104056
CVE-2026-104056
CVSS Score
9.8
EPSS Score
0.1%
EPSS Percentile
1th
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
| Vendor | authlib |
| Product | authlib |
| Published | Oct 1, 2026 |
| Last Updated | Oct 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for authlib authlib
Be the first to know when new critical vulnerabilities affecting authlib authlib are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Authlib / Authlib
1.7.2