Threats tagged 'pysec-2026-4359'

Authlib versions prior to 1.9.0 contain a vulnerability in the OpenIDImplicitGrant.validate_authorization_request() method where the client-controlled raw request payload scope is checked instead of the filtered allowed scopes. This allows a registered client permitted an ID token response type but not the openid scope to add openid to the request, obtain user consent, and receive a signed ID token with user subject and profile claims. The issue is fixed in version 1.9.0.