CERT24PYSEC-2026-4354: Authlib loopback URL validation bypassLoading data…
CERT24Threat Observatory
Period

PYSEC-2026-4354: Authlib loopback URL validation bypass

In Authlib versions 0.13 through 1.7.2, a flawed textual prefix check can incorrectly treat an external HTTP URL as a secure loopback URL. The issue is fixed in version 1.8.0. The source rates the severity as low.

← Back to intelligence

PYSEC-2026-4354: Authlib loopback URL validation bypass

In Authlib versions 0.13 through 1.7.2, a flawed textual prefix check can incorrectly treat an external HTTP URL as a secure loopback URL. The issue is fixed in version 1.8.0. The source rates the severity as low.