PyPI/authlib CVE-2026-41479: medium 5.4, EPSS 0.26%

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect whe

Action: Upgrade authlib to 1.6.10 or later.

pip install authlib==1.6.10

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2119
• https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096
• https://github.com/authlib/authlib/security/advisories/GHSA-w8p2-r796-3vmq

CVE-2026-41479 · published 2026-06-22T21:16:24.017Z · modified 2026-07-13T07:15:15.617934943Z · JSON