Vulnerability · CVE-2026-114619
Incorrect Authorization
Published Oct 22, 2026 · catalog updated Oct 30, 2026 · Red Hat Red Hat Enterprise Linux
Last checked Nov 5, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-114619. EPSS is 0.16%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.
Gaps on this record
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
Same product and reporting
- CVE-2026-114366 · Low
- CVE-2026-77299 · High
- CVE-2026-85068 · Low
- CVE-2026-92698 · High
- CVE-2026-92697 · High
- Severity
- Medium4.6
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.16%
- Remediation
- Version ranges on file
- Affected products
- PyPI authlib · package pip · pip authlib · pypi authlib
## Report metadata | Field | Value | | --- | --- | | Package | (PyPI, ) | | Repository | https://github.com/authlib/authlib | | Component | | | Vulnerability class | Authorization bypass: a client's scope restriction is bypassed for OpenID Connect ID token issuance | | Verified against | (v1.8.0). Earlier releases were not checked. | | API surface | Public API ( , registered with ) | | Affected in default configuration | Yes. No non-default option is needed once is registered. Client metadata decides exposure: Authlib's standard checks response type and scope independently, so a client can be permitted responses without being allowed the scope. | ## Summary first runs the parent validation, which filters the requested scope through and stores the result in . It then decides whether this is an OpenID request by checking the raw, client-supplied instead of that filtered value. A client that is allowed but not can therefore request , pass the check, and receive a signed ID token (with and profile claims) once the user consents. This happens even when Authlib's built-in, scope-filtering is in use. The tainted input is the authorization request's parameter. The OAuth client fully controls it, and the client is the very party the scope restriction is meant to constrain. Any registered client can add to its request if it is permitted an or response type and its allowed scopes exclude but include a claim-bearing scope such as . Sibling paths treat the same client correctly, which suggests the raw-scope check is a bug rather than intended behaviour: - -> filters the requested scope through into (safe, [ lines 141-147](https://github.com/authlib/authlib/blob/c529a61af40e3efe05286140e00fbdced07d7987/authlib/oauth2/rfc6749/grants/implicit.py#L141-L147)) - -> **checks the raw (unsafe, [ line 72](https://github.com/authlib/authlib/blob/c529a61af40e3efe05286140e00fbdced07d7987/authlib/oidc/core/grants/implicit.py#L72))** - -> rejects the same client's access token with 403 (safe;
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI authlib0 → 1.9.0
- package pipversion unspecified
- pip authlib< 1.9.0
- pypi authlibversion unspecified
How to fix CVE-2026-114619
Upgrade
CVE-2026-114619 lists a fix boundary at 1.9.0. Compare the installed build with that boundary before you change production.
Version check
Affected < 1.9.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-114619. EPSS is 0.16%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.
Which versions are affected?
Compare what you have installed with 0 → 1.9.0, < 1.9.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-807; CWE-863: Incorrect Authorization. EPSS 0.16%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 22, 2026 · Red Hat Security Data
Detected
authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant
Oct 27, 2026 · GitHub Advisory Database
Updated
## Report metadata | Field | Value | | --- | --- | | Package | (PyPI, ) | | Repository | https://github.com/authlib/authlib | | Component | | | Vulnerability class | Authorization bypass: a client's scope restriction is bypassed for OpenID Connect ID token issuance | | Verified against | (v1.8.0). Earlier releases were not checked. | | API surface | Public API ( , registered with ) | | Affected in
Oct 30, 2026 · PyPA Advisory Database
Fix available
authlib fixed in 1.9.0
Oct 30, 2026 · PyPA Advisory Database
Fix available
authlib fixed in 1.9.0
Oct 30, 2026 · PyPA Advisory Database
Updated
## Report metadata | Field | Value | | --- | --- | | Package | (PyPI, ) | | Repository | https://github.com/authlib/authlib | | Component | | | Vulnerability class | Authorization bypass: a client's scope restriction is bypassed for OpenID Connect ID token issuance | | Verified against | (v1.8.0). Earlier releases were not checked. | | API surface | Public API ( , registered with ) | | Affected in
Sources
- CVE.orgVulnerability recordCVE-2026-114619
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-114619
30-day exploitation probability 0.16%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-q686-2qmg-hqc7
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-114619
OpenIDImplicitGrant.validate_authorization_request() first runs the parent ImplicitGrant validation, which filters the requested scope through client.get_allowed_scope() and stores the result in request.scope. It then decides whether this is an OpenID request by checking the raw, client-supplied request.payload.scope instead of that filtered value. A client that is allowed profile but not openid c
advisories.gitlab.com - PyPA Advisory DatabasePackage advisoryGHSA-q686-2qmg-hqc7
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
osv.dev - PyPA Advisory DatabasePackage advisoryPYSEC-2026-4359
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope.
osv.dev - Red Hat Security DataVendor advisoryCVE-2026-114619
authlib: authlib: authorization bypass via improper scope check in OpenID implicit grant
access.redhat.com - Snyk Vulnerability DatabasePackage advisorySNYK-PYTHON-AUTHLIB-21460691
Incorrect Authorization
security.snyk.io
References
Freshness
Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 5, 2026
- PyPA Advisory DatabaseOct 30, 2026
- PyPA Advisory DatabaseOct 30, 2026
- GitLab Advisory DatabaseOct 28, 2026
- GitHub Advisory DatabaseOct 28, 2026
- Snyk Vulnerability DatabaseOct 25, 2026
- Red Hat Security DataOct 24, 2026
- CVE.orgOct 23, 2026