Python authlib: Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. (CVE-2026-104056)

The vulnerability in python-authlib version 1.7.2 and earlier involves caching discovery JSON metadata without validating the data or binding it to the issuer's origin. As a result, an attacker can provide a malicious discovery response that substitutes legitimate endpoint URLs with attacker-controlled endpoints. This compromises the integrity of the metadata used by the client, enabling potential full compromise of confidentiality, integrity, and availability as reflected by the CVSS 3.1 score of 9.8.

Successful exploitation allows an attacker to control all endpoint values in the discovery metadata, which can lead to complete compromise of the authentication flow, including interception or manipulation of tokens and credentials. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid trusting discovery metadata from untrusted sources or implement additional validation controls if possible.