Threats tagged 'ghsa-x4rv-c3wx-4cr8'

Authlib versions 1.6.0 through before 1.9.0 contain a vulnerability in the RFC 9101 JAR extension where the attacker-controlled request_uri parameter is passed to a fetch hook without validation at a pre-authentication endpoint. This allows an unauthenticated Server-Side Request Forgery (SSRF) primitive because the documented example implementation performs an unrestricted HTTP GET on the request_uri. The vulnerability arises because the existing allowlist controls for request_uris are ignored, and the extension does not implement required RFC 9101 controls such as validating the URI location, media type, or timeouts. A fix is available in version 1.9.0.