CVE-2026-114620: CVE-2026-114620: Server-Side Request Forgery in Authlib RFC 9101 JWT-Secured Authorization Request

#security #cve #cybersecurity

CVE-2026-114620: Server-Side Request Forgery in Authlib RFC 9101 JWT-Secured Authorization Request

Vulnerability ID: CVE-2026-114620
CVSS Score: 5.4
Published: 2026-10-27

Authlib versions prior to 1.9.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the RFC 9101 JWT-Secured Authorization Request (JAR) server implementation. The JWTAuthenticationRequest class passes an unauthenticated, client-controlled request_uri parameter directly to the abstract get_request_object() method before applying any destination validation or client registration policies. Because the official documentation previously recommended implementing this hook as an unrestricted HTTP fetch, deployments following those guidelines allow remote attackers possessing a valid public client_id to trigger outbound network requests to internal services and infer fetch outcomes via error response variations.

TL;DR

Authlib < 1.9.0 passes unauthenticated request_uri parameters to get_request_object() without prior validation in its RFC 9101 implementation. If downstream applications implement this method using unrestricted HTTP fetches as shown in legacy documentation, attackers with a valid client_id can perform blind SSRF and internal network reconnaissance via error response differentiation.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: Server-Side Request Forgery (CWE-918)
Affected Component: authlib.oauth2.rfc9101.JWTAuthenticationRequest
Attack Vector: Network (Unauthenticated HTTP GET to OAuth Authorization Endpoint)
CVSS v3.1 Score: 5.4 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
EPSS Score: 0.29% (21.46th Percentile)
Impact: Blind SSRF, Internal Port/Service Scanning via Error Oracle
Exploit Status: Proof-of-Concept (Unit Test Suite)
Patched Version: authlib 1.9.0

Affected Systems

Authlib (Python package)
authlib: < 1.9.0 (Fixed in: 1.9.0)

Code Analysis

Commit: 6563f6f

Enforce request_uri validation in JWTAuthenticationRequest before invoking get_request_object.

Commit: 891e3f1

Decouple generic RFC 9101 JAR validation policy from OpenID Connect request_uri registration via OpenIDJWTAuthenticationRequest.

Mitigation Strategies

Upgrade Authlib to version 1.9.0 or later to enforce pre-fetch URI validation.
Require pre-registration of request_uri values per OAuth client and validate exact string matches before initiating any network connection.
Disable request_uri support (support_request_uri=False) if clients can pass JAR payloads by value using the request parameter.
Harden the outbound HTTP client in get_request_object() by enforcing HTTPS, disabling redirects, restricting resolved IP addresses to public routable space, and enforcing strict timeouts and response size limits.

Remediation Steps:

Update package dependencies (pip install 'authlib>=1.9.0').
Locate all subclasses of authlib.oauth2.rfc9101.JWTAuthenticationRequest in the application codebase.
Implement the validate_request_uri(self, request_uri: str, client: ClientMixin) -> bool method to verify that request_uri exactly matches an entry in the client's pre-registered request_uris allowlist.
For OpenID Connect servers, migrate to OpenIDJWTAuthenticationRequest and configure require_request_uri_registration to True in server metadata.
Audit get_request_object() to ensure it uses allow_redirects=False (or follow_redirects=False), enforces short connection/read timeouts, limits response payload size, and blocks connections to private, loopback, and link-local IP addresses.

References

Read the full report for CVE-2026-114620 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community