Threats tagged 'pysec-2026-4360'

Authlib versions prior to 1.9.0 contain a vulnerability in the RFC 9101 JWTAuthenticationRequest implementation where the unauthenticated, client-controlled request_uri parameter is passed to a hook before destination validation. This can allow a remote attacker with a valid public client ID to induce the authorization server to fetch unintended internal or link-local URLs if the integrator's hook performs unrestricted outbound fetches. The issue is fixed in version 1.9.0.