CVE-2026-114617 | Authlib up to 1.8.x OpenID Connect sync_openid.py OpenIDMixin.parse_id_token authentication replay

October 22, 2026 Yanac

A vulnerability was found in Authlib up to 1.8.x. It has been classified as critical. Impacted is the function OpenIDMixin.parse_id_token of the file authlib/integrations/base_client/sync_openid.py of the component OpenID Connect. The manipulation leads to authentication bypass by capture-replay.

This vulnerability is uniquely identified as CVE-2026-114617. The attack is possible to be carried out remotely. No exploit exists.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More