CVE-2026-41425: Authlib CSRF Vulnerability

CVE-2026-41425 Overview

CVE-2026-41425 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Authlib, a Python library used for building OAuth and OpenID Connect servers. Prior to version 1.6.11, the cache feature in authlib.integrations.starlette_client.OAuth lacks CSRF protection, potentially allowing attackers to perform unauthorized actions on behalf of authenticated users.

Critical Impact

Applications using Authlib's Starlette OAuth integration with the cache feature are vulnerable to CSRF attacks, which could allow attackers to forge authentication requests and potentially compromise user sessions or perform unauthorized OAuth operations.

Affected Products

• Authlib versions prior to 1.6.11
• Applications using authlib.integrations.starlette_client.OAuth with cache features
• Python web applications built with Starlette framework utilizing Authlib OAuth integration

Discovery Timeline

• 2026-04-24 - CVE-2026-41425 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-41425

Vulnerability Analysis

This vulnerability (CWE-352: Cross-Site Request Forgery) exists in the Starlette client integration module of Authlib. The cache feature within authlib.integrations.starlette_client.OAuth does not implement proper CSRF token validation, creating a security gap in the OAuth authentication flow.

When an application uses the Starlette OAuth client with caching enabled, the absence of CSRF protection allows malicious actors to craft forged requests that the server may accept as legitimate. This is particularly concerning in OAuth implementations where state parameters and anti-forgery tokens are critical security controls.

The vulnerability requires user interaction—specifically, a victim must visit an attacker-controlled page or click a malicious link while authenticated to the target application. Successful exploitation could lead to unauthorized OAuth operations being performed under the victim's authenticated session.

Root Cause

The root cause is the missing implementation of CSRF protection mechanisms in the cache feature of the Starlette OAuth client integration. OAuth implementations typically rely on state parameters to prevent CSRF attacks during the authorization flow. The cache implementation in affected versions fails to properly validate or enforce these protections, allowing forged requests to bypass security controls.

Attack Vector

The attack is network-based and requires user interaction. An attacker could exploit this vulnerability by:

1. Crafting a malicious web page or email containing a forged request
2. Enticing an authenticated user to visit the malicious content
3. The forged request is sent to the vulnerable application without proper CSRF validation
4. The application processes the unauthorized OAuth operation as if it were a legitimate user request

Due to the nature of CSRF vulnerabilities, the attacker cannot directly access the response, but they can trigger state-changing operations within the OAuth flow.

The vulnerability exists in the OAuth state management when using the Starlette integration's cache feature. Without proper CSRF token validation, the OAuth authorization callback can be manipulated to accept forged authorization codes or bypass state verification. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-41425

Indicators of Compromise

• Unusual OAuth authorization requests originating from unexpected referrer URLs
• Multiple authorization callbacks with invalid or missing state parameters
• Authentication anomalies where OAuth tokens are issued without corresponding legitimate user sessions
• Unexpected session modifications or OAuth token grants in application logs

Detection Strategies

• Monitor OAuth callback endpoints for requests with missing or manipulated CSRF tokens
• Implement logging and alerting for OAuth state parameter mismatches
• Audit application logs for unusual patterns in OAuth authorization flows
• Analyze web server logs for requests to OAuth endpoints from suspicious referrers

Monitoring Recommendations

• Enable detailed logging for all OAuth-related endpoints in Starlette applications
• Monitor for CSRF-related security events in web application firewalls (WAF)
• Set up alerts for failed state parameter validations in OAuth flows
• Review Authlib integration configurations to ensure proper security settings are enabled

How to Mitigate CVE-2026-41425

Immediate Actions Required

• Upgrade Authlib to version 1.6.11 or later immediately
• Review application logs for any signs of exploitation
• Audit current OAuth integration configurations for additional security gaps
• Consider implementing additional CSRF protection layers at the application level

Patch Information

The vulnerability is fixed in Authlib version 1.6.11. Users should upgrade to this version or later to receive the security fix. The patch addresses the missing CSRF protection in the Starlette client OAuth cache feature. For more details, refer to the GitHub Security Advisory.

Workarounds

• If immediate upgrade is not possible, consider temporarily disabling the cache feature in authlib.integrations.starlette_client.OAuth
• Implement additional application-level CSRF protection for OAuth endpoints
• Use session-based state management instead of cache-based approaches where feasible
• Deploy a WAF with CSRF protection rules to add a defensive layer

# Upgrade Authlib to the patched version
pip install --upgrade authlib>=1.6.11

# Verify installed version
pip show authlib | grep Version