CVE-2026-116672

Name of the Vulnerable Software and Affected Versions Authlib versions 0.15 through 1.9.0

Description Reference implementations of ClientConfigurationEndpoint.authenticate client() and ClientConfigurationEndpoint.check permission() look up a target client using client id data from the request and verify if the target is editable, but fail to verify if the request.credential belongs to that target client. This allows a client with any valid registration access token to read, modify, or delete the registration of another client. Modifying redirect uris can lead to authorization code or token interception, and deleting registrations can result in a denial of service for the affected clients.

Recommendations Update to version 1.9.1.