CVE-2026-104056 Overview
CVE-2026-104056 affects Authlib version 1.7.2 and below. The library caches OpenID Connect and OAuth 2.0 discovery JSON metadata without validating the response or binding endpoint values to the issuer origin. An attacker who can poison the discovery response can replace all endpoint URLs with attacker-controlled values. Authlib does not require that returned endpoints share the origin of the configured server metadata URL. The flaw maps to CWE-345: Insufficient Verification of Data Authenticity.
Critical Impact
A poisoned discovery document redirects authorization, token, and userinfo endpoints to attacker-controlled hosts, enabling credential theft, token interception, and full authentication bypass against relying parties.
Affected Products
- Authlib 1.7.2 and all prior versions
- Python applications relying on Authlib for OAuth 2.0 client flows
- Python applications relying on Authlib for OpenID Connect (OIDC) discovery
Discovery Timeline
- 2026-10-01 - CVE-2026-104056 published to the National Vulnerability Database
- 2026-10-05 - Last updated in NVD database
Technical Details for CVE-2026-104056
Vulnerability Analysis
Authlib fetches server metadata from a discovery URL such as /.well-known/openid-configuration and caches the resulting JSON for reuse. The library accepts endpoint values from the response without checking that they share the origin of the configured metadata URL. Any field in the cached document, including authorization_endpoint, token_endpoint, userinfo_endpoint, and jwks_uri, can therefore point to an attacker-controlled host. Subsequent OAuth and OIDC flows will transparently use those poisoned endpoints. Users will be redirected to adversary infrastructure for authorization, and tokens or credentials will be transmitted to that infrastructure. Because the cached response is trusted, poisoning persists across requests until the cache entry is evicted.
Root Cause
The root cause is missing issuer-origin validation on discovery metadata. Authlib treats the discovery document as authoritative without verifying that returned endpoint URLs match the origin of the metadata URL or the declared issuer claim. This is a classic [CWE-345] failure, where data authenticity is not verified before use.
Attack Vector
An attacker who can tamper with the discovery response—through DNS hijacking, a compromised upstream, a malicious proxy, or a misconfigured metadata URL—can inject arbitrary endpoint values. The attack requires no authentication and no user interaction on the relying party side. Once the poisoned document is cached, every downstream OAuth or OIDC request routes sensitive operations to the attacker. See the public write-up and proof of concept for a technical walkthrough.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104056
Indicators of Compromise
- Outbound HTTP requests from application hosts to unexpected authorization_endpoint or token_endpoint domains that do not match the configured identity provider.
- Discovery responses whose endpoint hostnames differ from the origin of the .well-known URL or the issuer claim.
- Unexplained OAuth state mismatches, failed token validations, or JWKS fetches from unknown hosts.
Detection Strategies
- Inventory Python dependencies and flag any deployment running Authlib 1.7.2 or earlier.
- Instrument the OAuth client to log the resolved endpoint URLs on every discovery refresh and alert on origin mismatches.
- Compare cached discovery documents against a known-good baseline for each configured identity provider.
Monitoring Recommendations
- Forward application and proxy logs to a centralized analytics platform and alert on OAuth endpoint drift.
- Monitor DNS resolution for identity provider domains to detect hijacking attempts that would feed a poisoned discovery response.
- Track certificate and TLS fingerprints for discovery and token endpoints to detect substitution.
How to Mitigate CVE-2026-104056
Immediate Actions Required
- Upgrade Authlib to a fixed release above 1.7.2 as soon as a patched version is published by the maintainer.
- Invalidate cached discovery documents on all application instances after upgrading.
- Audit all configured server metadata URLs and confirm they use HTTPS with strict certificate validation.
Patch Information
No vendor advisory URL is listed in the enriched CVE data. Monitor the Authlib project on GitHub for the fixed release, review the public technical write-up, and pin Authlib to the patched version in dependency manifests once available.
Workarounds
- Validate every endpoint returned by discovery against the origin of the metadata URL and the issuer claim before use.
- Hard-code trusted authorization_endpoint, token_endpoint, userinfo_endpoint, and jwks_uri values and bypass dynamic discovery where feasible.
- Restrict egress from application hosts so that OAuth traffic can only reach approved identity provider domains.
# Pin Authlib to a non-vulnerable release once published
pip install --upgrade 'authlib>1.7.2'
# Verify the installed version
python -c "import authlib; print(authlib.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
