Threats tagged 'ghsa-q686-2qmg-hqc7'

Authlib versions prior to 1.9.0 contain a vulnerability in the OpenID Connect implicit grant implementation where the authorization request's raw scope parameter is checked instead of the filtered allowed scope. This allows a registered OAuth client, which is not permitted the 'openid' scope but allowed other scopes like 'profile', to obtain a signed ID token if the user consents. The ID token includes identity claims such as 'sub' and 'name', effectively bypassing intended scope restrictions. The issue is fixed in version 1.9.0.