Vulnerability · CVE-2026-116672
Authlib RFC 7592 examples omit registration-access-token client binding
Published Oct 30, 2026 · catalog updated Oct 30, 2026 · Authlib RFC 7592 examples
Last checked Nov 7, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116672. EPSS is 0.27%. Act only if a listed version of Authlib RFC 7592 examples is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Authlib RFC 7592 examples).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High8.8
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.27%
- Remediation
- Version ranges on file
- Affected products
- PyPI authlib · pip Authlib · pypi authlib
## Description ### Summary RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously registered client read, update, or delete its own registration, authenticated by a issued specifically to that client at registration time. The entire security model of this protocol depends on the server verifying that the token presented in the request actually belongs to the client identified in the request, not merely that the token is valid for some client. Authlib's implements the control flow correctly in structure, calling , then , then , and treats all three as abstract methods that "Developers MUST implement in subclass." The problem is that the documented example implementations for these methods, taken together exactly as written, never perform the one check that matters: binding the authenticated token to the specific client being accessed. A developer who implements these methods by following the provided examples ends up with a complete authorization bypass on this endpoint. ### Details 's documented example ( ): This looks the target client up purely by the supplied in the request payload, with no reference to the token at all. 's documented example, in the same file: This checks a property of the target client alone (whether it is generally "editable"), again with no reference to , the authenticated token object returned earlier by and stored on the request specifically so that later steps can check it: is set specifically so that a binding check can be performed downstream, but neither documented example ever reads it. Following both examples as written produces an implementation where the only requirements to access, modify, or delete a client's registration are: possessing any valid registration_access_token for any client, and knowing or guessing the target . This is meaningfully different from how the equivalent example is written for the token introspection endpoint (RFC 7662) elsewhere in the same codebase, which does correctly de
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI authlib0.15 → 1.9.1
- pip Authlib>= 0.15, <= 1.9.0
- pypi authlibversion unspecified
How to fix CVE-2026-116672
Upgrade
CVE-2026-116672 lists a fix boundary at 1.9.1. Compare the installed build with that boundary before you change production.
Version check
Affected <= 1.9.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116672. EPSS is 0.27%. Act only if a listed version of Authlib RFC 7592 examples is installed.
Which versions are affected?
Compare what you have installed with Authlib >= 0.15, <= 1.9.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-1188; CWE-639: Authorization Bypass Through User-Controlled Key. EPSS 0.27%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 30, 2026 · GitHub Advisory Database
Detected
## Description ### Summary RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously registered client read, update, or delete its own registration, authenticated by a issued specifically to that client at registration time. The entire security model of this protocol depends on the server verifying that the token presented in the request actually belongs to the client
Oct 30, 2026 · GitHub Advisory Database
Fix available
authlib fixed in 1.9.1
Oct 30, 2026 · GitHub Advisory Database
Fix available
authlib fixed in 1.9.1
Oct 30, 2026 · GitHub Advisory Database
Updated
## Description ### Summary RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously registered client read, update, or delete its own registration, authenticated by a issued specifically to that client at registration time. The entire security model of this protocol depends on the server verifying that the token presented in the request actually belongs to the client
Sources
- CVE.orgVulnerability recordCVE-2026-116672
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-c73q-w75p-j82v
Authlib RFC 7592 examples omit registration-access-token client binding
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116672
RFC 7592 (OAuth 2.0 Dynamic Client Registration Management Protocol) lets a previously registered client read, update, or delete its own registration, authenticated by a registration_access_token issued specifically to that client at registration time. The entire security model of this protocol depends on the server verifying that the token presented in the request actually belongs to the client i
advisories.gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-c73q-w75p-j82v
Authlib RFC 7592 examples omit registration-access-token client binding
osv.dev - PyPA Advisory DatabasePackage advisoryGHSA-c73q-w75p-j82v
Authlib RFC 7592 examples omit registration-access-token client binding
osv.dev
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- GitHub Advisory DatabaseNov 7, 2026
- GitLab Advisory DatabaseNov 3, 2026
- PyPA Advisory DatabaseNov 2, 2026
- CVE.orgOct 31, 2026
- OpenSSF OSV / OSV ScannerOct 31, 2026