Authlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-114617
Summary OpenIDMixin.parseidtoken() reads the noncesupported claim from the ID token it is validating. When that claim is boolean false, the expected nonce is set to None and nonce validation is skipped for that token. An ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party. The code is identical in authlib/integrations/baseclient/syncopenid.py:82-83 and authlib/integrations/baseclient/asyncopenid.py:84-85, so all framework integrations are affected. Fixed versions: none; reproduced on 1.8.0 (commit c529a61a). Preconditions: the ID token must carry a valid signature and pass iss and aud validation, and the attacker must be able to supply it to parseidtoken(). Authorization code flow is not affected. Implicit and hybrid relying parties, and applications calling parseidtoken() directly, are affected. Details Affected code authlib/integrations/baseclient/syncopenid.py:80-85, in parseidtoken(): python claims = claimscls(token.claims, token.header, claimsoptions,…
Assessment
- CVSS
- 4.2 (v3.1)
- Severity
- Medium
- EPSS
- 0.00265% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 27 October 2026
- Last updated
- 27 October 2026
- Affected
- pip · authlib
- Weakness
- CWE-294, CWE-807
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
At the source
References
- https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc
- https://nvd.nist.gov/vuln/detail/CVE-2026-114617
- https://github.com/authlib/authlib/pull/949
- https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0
- https://github.com/authlib/authlib/releases/tag/v1.9.0
- https://github.com/advisories/GHSA-c5mf-xmp2-59rc
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-114617