ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-114614

Open Redirect

Published Oct 22, 2026 · catalog updated Oct 30, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-114614. EPSS is 0.27%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Low3.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.27%
Remediation
Version ranges on file
Affected products
PyPI authlib · package pip · pip authlib · pypi authlib

### Summary is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback URIs. The check is implemented as a textual prefix match, so a URL such as — whose actual host is and whose scheme is plain — is accepted as "secure". An attacker who can supply a URL to any of the sinks that rely on this check (OIDC RP-Initiated Logout dynamic client registration, RFC 8414 authorization-server metadata validation, error-redirect rendering) can smuggle a cleartext non-loopback URL past the TLS-required guard. This is a defense-in-depth / spec-conformance failure; severity is low. ### Details **Affected versions:** (all releases containing the loopback prefix exemption; verified against 1.7.2, the current latest) The vulnerable function, from at v1.7.2: Per RFC 3986 §3.2 the authority component of a URI is . The URL therefore has userinfo and host . Because the check is a raw prefix match against the full URL string, the prefix matches the userinfo portion and the function returns even though the scheme is and the host is an arbitrary external name. The trailing in each allow-list entry — presumably intended to force a shape and reject — is also satisfied by the separator inside userinfo, so matches too. The same construction works against all three loopback prefixes ( , ). is consumed at the following locations in v1.7.2, none of which independently reject URLs containing a userinfo component: - — validation of during OIDC dynamic client registration for public clients ( ). The preceding check ( ) only requires and does **not** reject userinfo, so the crafted URL passes both guards. A public client can therefore register as a post-logout redirect target; the OpenID Provider will later 302 the end-user's browser to that cleartext non-loopback URL (carrying ). - — validation of , , , , , , in Authorization Server Metadata / OIDC Discovery documents. A relying party using would accept e

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI authlib0 → 1.8.0
  • PyPI authlib0.13 → 1.8.0
  • package pipversion unspecified
  • pip authlib<= 1.7.2
  • pypi authlibversion unspecified

How to fix CVE-2026-114614

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-114614. EPSS is 0.27%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.8.0, 0.13 → 1.8.0, <= 1.7.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-319: Cleartext Transmission of Sensitive Information; CWE-601: URL Redirection to Untrusted Site (Open Redirect); CWE-693: Protection Mechanism Failure. EPSS 0.27%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 22, 2026 · Red Hat Security Data

    Detected

    authlib: Authlib: Transport security bypass via improper URL validation

  2. Oct 27, 2026 · GitHub Advisory Database

    Updated

    ### Summary is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback URIs. The check is implemented as a textual prefix match, so a URL such as — whose actual host is and whose scheme is plain — is accepted as "secure". An attacker who can supply a URL to any of the sinks that rely on this check (OI

  3. Oct 30, 2026 · PyPA Advisory Database

    Fix available

    authlib fixed in 1.8.0

  4. Oct 30, 2026 · PyPA Advisory Database

    Fix available

    authlib fixed in 1.8.0

  5. Oct 30, 2026 · PyPA Advisory Database

    Updated

    ### Summary is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback URIs. The check is implemented as a textual prefix match, so a URL such as — whose actual host is and whose scheme is plain — is accepted as "secure". An attacker who can supply a URL to any of the sinks that rely on this check (OI

Sources

  • CVE.orgVulnerability recordCVE-2026-114614

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-114614

    30-day exploitation probability 0.27%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-jj7h-c3hg-m23x

    Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-114614

    authlib.common.security.is_secure_transport() is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL such as http://localhost:80@evil.example/cb — whose actual host is evil.example and whose scheme is plain h

    advisories.gitlab.com
  • PyPA Advisory DatabasePackage advisoryGHSA-jj7h-c3hg-m23x

    Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

    osv.dev
  • PyPA Advisory DatabasePackage advisoryPYSEC-2026-4354

    Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even

    osv.dev
  • Red Hat Security DataVendor advisoryCVE-2026-114614

    authlib: Authlib: Transport security bypass via improper URL validation

    access.redhat.com
  • Snyk Vulnerability DatabasePackage advisorySNYK-PYTHON-AUTHLIB-21460694

    Open Redirect

    security.snyk.io

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 5, 2026
  • PyPA Advisory DatabaseOct 30, 2026
  • PyPA Advisory DatabaseOct 30, 2026
  • GitLab Advisory DatabaseOct 28, 2026
  • GitHub Advisory DatabaseOct 28, 2026
  • Snyk Vulnerability DatabaseOct 25, 2026
  • Red Hat Security DataOct 24, 2026
  • CVE.orgOct 23, 2026