CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.

• CWE-601
• CWE-693

• https://github.com/authlib/authlib/commit/95ad1f90acf0c7b9cf2a8f25e6eb3f1135b8dc70
• https://github.com/authlib/authlib/releases/tag/v1.8.0
• https://github.com/authlib/authlib/security/advisories/GHSA-jj7h-c3hg-m23x

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114609fpdf2 is a PDF creation library for Python. Prior to 2.8.8, …5.8
• CVE-2026-11461A vulnerability has been found in NousResearch hermes-agent …6.3
• CVE-2026-114610fpdf2 is a PDF creation library for Python. From 2.5.0 until…6.5
• CVE-2026-114611OCO-Server is a self-hosted endpoint management application …9.1
• CVE-2026-114612LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…9.9
• CVE-2026-114613MessagePack is the serializer implementation for Python msgp…7.5
• CVE-2026-11462A vulnerability was found in Chengdu Everbrite Network Techn…7.3
• CVE-2026-114625VeloCloud Orchestrator (VCO) on-prem has a security issue wh…9.9
• CVE-2026-11463A vulnerability was determined in USCiLab Cereal up to 1.3.2…7.3
• CVE-2026-114633WWBN AVideo before 29.4.0 contains an incorrect authorizatio…6.5
• CVE-2026-114634WWBN AVideo before 29.4.0 contains a blind server-side reque…4.3
• CVE-2026-114635Traefik before v2.11.58 and v3.7.14 contains an authenticati…8.7