CVE-2026-116672: CVE-2026-116672: Authorization Bypass in Authlib RFC 7592 Client Configuration Endpoint

#security #cve #cybersecurity

CVE-2026-116672: Authorization Bypass in Authlib RFC 7592 Client Configuration Endpoint

Vulnerability ID: CVE-2026-116672
CVSS Score: 8.8
Published: 2026-10-30

Authlib versions 0.15 through 1.9.0 contain an authorization bypass vulnerability (CWE-639) in the RFC 7592 ClientConfigurationEndpoint implementation and its corresponding reference documentation. The framework fails to verify that the presented registration access token belongs to the target client specified in the request, and the official reference implementations for authenticate_client and check_permission omit token-to-client binding checks. Consequently, an authenticated client holding any valid registration access token can read, modify, or delete the registration metadata of arbitrary clients on the authorization server.

TL;DR

An Insecure Direct Object Reference (IDOR) flaw in Authlib's RFC 7592 ClientConfigurationEndpoint allows any client with a valid registration access token to read, modify, or delete other clients' OAuth 2.0 configurations, including client secrets and redirect URIs. Upgrading to Authlib 1.9.1 enforces mandatory token-client binding within the endpoint processing pipeline.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: Insecure Direct Object Reference (IDOR) / Authorization Bypass
CWE ID: CWE-639 / CWE-1188
CVSS v3.1 Score: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected Component: authlib.oauth2.rfc7592.ClientConfigurationEndpoint
Affected Versions: >= 0.15, < 1.9.1
Patched Version: 1.9.1
EPSS Score: 0.27% (19.83rd percentile)
CISA KEV Status: Not Listed

Affected Systems

Authlib (PyPI package authlib)
Authlib: >= 0.15, < 1.9.1 (Fixed in: 1.9.1)

Code Analysis

Commit: 1bd2a31

The client configuration endpoint rejects a registration access token issued to another client. The documentation examples read the client_id from the endpoint URL instead of the request body.

@@ -39,6 +39,11 @@ def create_configuration_response(self, request):
                 status_code=401, description="The client does not exist on this server."
             )

+        # The registration access token is only valid for the client it was
+        # issued to.
+        if not token.check_client(client):
+            raise AccessDeniedError()
+
         if not self.check_permission(client, request):

Exploit Details

GitHub: Official patch commit containing regression test cases demonstrating cross-client read, update, and delete requests.

Mitigation Strategies

Upgrade Authlib to version 1.9.1 or later to enable framework-level enforcement of token-to-client binding in ClientConfigurationEndpoint.
Enforce explicit verification between request.credential (the registration access token) and the target client record inside check_permission.
Ensure the token model returned by authenticate_token properly subclasses TokenMixin and implements strict client_id matching in check_client.
Audit access logs on RFC 7592 client configuration endpoints for a single bearer token accessing multiple distinct client_id paths.

Remediation Steps:

Update the Python environment dependency to Authlib >= 1.9.1 via pip: pip install --upgrade "authlib>=1.9.1".
Inspect the custom ClientConfigurationEndpoint subclass to confirm authenticate_token returns a token instance implementing check_client(client).
Update authenticate_client in any custom ClientConfigurationEndpoint subclass to extract client_id from the URL path rather than exclusively from the request JSON payload.
Add unit and integration tests verifying that GET, PUT, and DELETE requests using a registration access token issued to another client fail with HTTP 400 access_denied.

References

Read the full report for CVE-2026-116672 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community