Control: clone -1 -2 Control: retitle -1 python-authlib: CVE-2026-114614 CVE-2026-114615 CVE-2026-114616 CVE-2026-114617 CVE-2026-114618 CVE-2026-114619 CVE-2026-114620 Control: retitle -2 python-authlib: CVE-2026-104056
Hi Salvatore (2026.10.23_22:51:02_+0200)
CVE-2026-104056[0]: | Authlib version 1.7.2 and below contains a vulnerability where | discovery JSON metadata is cached without validation or issuer- | origin binding. This allows a poisoned discovery response to replace | all endpoint values with attacker-controlled values rather than | endpoint URLs that share the origin of the configured server | metadata URL.
We're going to have to deal with this one separately, fixing it is going to be more complex.
https://github.com/authlib/authlib/issues/967 https://github.com/authlib/authlib/pull/948 Stefano -- Stefano Rivera http://tumbleweed.org.za/ +1 415 683 3272
