CVE-2026-114620

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0

Description In the RFC 9101 JWTAuthenticationRequest implementation within authlib/oauth2/rfc9101/authorization server.py, the unauthenticated and client-controlled request uri parameter is passed to the abstract get request object() function before a destination or registration policy is applied. If an integrator implements this hook as an unrestricted outbound fetch, a remote attacker with a valid public client identifier can force the authorization server to request internal, link-local, or other unintended URLs. The attacker can then distinguish the results of these fetches through timing differences and varying error responses.

Recommendations Update to version 1.9.0. As a temporary mitigation, ensure the get request object() hook implements a secure allowlist, destination controls, and retrieval limits.