Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlibs RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0.
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Authlib | Authlib | 1.6.0 (including) | 1.9.0 (excluding) |
Related Attack Patterns
References
- https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0
- https://github.com/authlib/authlib/commit/891e3f10ae5989176211f8be35dcc7cd40aa92c6
- https://github.com/authlib/authlib/pull/949
- https://github.com/authlib/authlib/releases/tag/v1.9.0
- https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8
- https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8