CERT24PYSEC-2026-4359: Authlib OpenID Connect implicit authorization scope validation flawLoading data…
CERT24Threat Observatory
Period

PYSEC-2026-4359: Authlib OpenID Connect implicit authorization scope validation flaw

In Authlib versions before 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-supplied raw scope instead of the already filtered allowed scope. A registered OAuth client permitted to use an ID-token response type, but not the openid scope, can add openid to the request and receive a signed ID token after the user consents.

← Back to intelligence

PYSEC-2026-4359: Authlib OpenID Connect implicit authorization scope validation flaw

In Authlib versions before 1.9.0, OpenIDImplicitGrant.validate_authorization_request() checks the client-supplied raw scope instead of the already filtered allowed scope. A registered OAuth client permitted to use an ID-token response type, but not the openid scope, can add openid to the request and receive a signed ID token after the user consents.