{"schema":"threatline.record/2","record":{"id":"CVE-2026-116672","aliases":["GHSA-c73q-w75p-j82v"],"summary":"Authlib RFC 7592 examples omit registration-access-token client binding","details":"Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client from request-controlled client_id data and check only whether that target is editable, without verifying that request.credential belongs to the target client. Deployments following both examples can allow a client holding any valid registration access token to read, modify, or delete another client's registration. Changing redirect_uris can enable authorization code or token interception, while deleting registrations can deny service to affected clients. This issue is fixed in version 1.9.1.","categories":["Unclassified"],"product":"authlib","vendor":"authlib","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116672","source_modified_at":"2026-10-27T16:31:48.429Z","fetched_at":"2026-10-27T21:14:11.489891Z","product":"authlib","vendor":"authlib","versions":[{"version":">= 0.15, < 1.9.1","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":8.8,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T16:31:48.429Z","modified_at":"2026-10-27T16:31:48.429Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116672","fetched_at":"2026-10-27T21:14:11.489891Z","source_modified_at":"2026-10-27T16:31:48.429Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/authlib/authlib/releases/tag/v1.9.1","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T16:31:48.429Z","content_hash":"5a8943dcddd8a597c405dff3ff657e14b33933464f5afc7596438ca45f398cfb"}}