CVE-2026-114620 | Authlib up to 1.8.x Jwt Authentication Request authorization_server.py get_request_object request_uri server-side request forgery (EUVD-2026-108522)

October 22, 2026 Yanac

A vulnerability has been found in Authlib up to 1.8.x and classified as critical. The affected element is the function get_request_object of the file authlib/oauth2/rfc9101/authorization_server.py of the component Jwt Authentication Request. The manipulation of the argument request_uri leads to server-side request forgery.

This vulnerability is traded as CVE-2026-114620. It is possible to initiate the attack remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More