CVE-2026-41479

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.10 Authlib versions prior to 1.7.1

Description Authlib's OAuth 2.0 authorization endpoint is susceptible to an unauthenticated open redirect. This occurs when a request utilizes an unsupported response type and provides an attacker-controlled redirect uri. The issue arises because the get authorization grant() function copies the raw redirect uri into an UnsupportedResponseTypeError before performing client lookup or redirect URI validation. Subsequently, the call () function in the base class automatically returns a 302 Location response to that URI. Consequently, an attacker can force the server to redirect to an arbitrary URL without needing a valid client registration, an authenticated user, or any prior state.

Recommendations Update to version 1.6.10 or later. Update to version 1.7.1 or later.