Authlib: Authorization bypass in RFC 7592 client configuration endpoint

Summary

Authlib, a Python library for OAuth and OpenID Connect servers, does not bind the registration access token to the client it was issued for in the documented RFC 7592 reference implementations. A client holding any valid registration access token can read, modify or delete the registration of another client. Changing redirect_uris can enable interception of authorization codes or tokens, and deleting registrations can cause denial of service. Exploitation requires that the application follows these reference implementations and allows a low-privileged client to obtain a registration access token.

Affected

• Authlib 0.15 up to and including 1.9.0 (>= 0.15, < 1.9.1)
• Applications that implement ClientConfigurationEndpoint following the documented reference implementations of authenticate_client and check_permission

Fixed in

• Authlib 1.9.1

Workaround

• No workaround documented by the vendor.
• If you cannot upgrade, make sure your check_permission and authenticate_client implementations verify that the token belongs to the target client.

Exploitation

• No confirmed in-the-wild exploitation known.
• No public proof-of-concept known.
• EPSS: 0.27 % (percentile 20).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Check whether Authlib is used in any Python application, for example with pip show authlib or in lockfiles.
• Upgrade affected installations to Authlib 1.9.1 and test first, as 1.9.x contains breaking changes.
• If your code follows the RFC 7592 documentation examples, verify token-to-client binding in your own code.
• Restrict open dynamic client registration, since an attacker needs a valid registration access token.
• Review changed or deleted client registrations and redirect_uris for anomalies.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-c73q-w75p-j82v github.com
• Fix commit 1bd2a31 github.com
• Authlib release v1.9.1 github.com
• Authlib RFC 7592 documentation docs.authlib.org
• Ubuntu CVE tracker ubuntu.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:11.