The vulnerability in Authlib's OAuth 2.0 authorization endpoint allows an attacker to trigger an open redirect by sending a request with an unsupported response_type and a malicious redirect_uri. This happens before any client verification or redirect URI validation, enabling redirection to arbitrary URLs without authentication or valid client credentials. The flaw affects versions prior to 1.6.10 and 1.7.1 and is resolved in these fixed versions.

An attacker can exploit this vulnerability to cause an unauthenticated open redirect, potentially facilitating phishing or redirecting users to malicious sites. The vulnerability does not require authentication, valid client registration, or prior state, increasing its ease of exploitation. The impact is limited to confidentiality and integrity as per the CVSS vector (C:L/I:L/A:N).

This vulnerability is fixed in Authlib versions 1.6.10 and 1.7.1. Users should upgrade to these versions or later to remediate the issue. No additional mitigation is required if these versions are deployed.