CVE-2026-116672 is a vulnerability in Authlib's implementation of the OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592). The provided example code for the ClientConfigurationEndpoint fails to bind the registration_access_token to the specific client being accessed, allowing an attacker with any valid token and knowledge of a client_id to bypass authorization and modify or delete client registrations. This flaw arises because the example implementations do not verify that the token belongs to the client targeted by the request. A fix is available in version 2.15.0_5.