Debian/python-authlib: critical 9.8
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all e
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: DEBIAN-CVE-2026-104056#Debian:14/python-authlib
- https://security-tracker.debian.org/tracker/CVE-2026-104056
published · modified · JSON