Threats tagged 'pysec-2026-4357'

Authlib versions prior to 1.9.0 contain a vulnerability in OpenIDMixin.parse_id_token() where the nonce_supported decision is read from an untrusted ID token. This flaw allows an attacker with a captured validly signed token to bypass nonce-to-session binding and replay the token into an attacker-controlled session in implicit and hybrid flows. The vulnerability does not affect the plain authorization code flow and requires the token to pass signature, issuer, and audience validation. The issue is fixed in version 1.9.0.