Threats tagged 'brew-kaskade-cve-2026-114620'

Authlib's implementation of the RFC 9101 JWT-secured authorization request (JAR) extension contains a security flaw where the attacker-controlled 'request_uri' parameter is passed to a fetch hook without validation at a pre-authentication endpoint. Although Authlib defines allowlists for 'request_uris' and requires registration, these controls are not enforced in the extension. The documented example implementation performs an unrestricted HTTP GET request on the 'request_uri', resulting in an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. This flaw was verified in Authlib version 1.7.2 and the current main branch. The vulnerability allows attackers to induce the server to make arbitrary HTTP requests, potentially exposing internal resources.