UBUNTU-CVE-2026-114614

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-114614
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114614.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2026-114614
Upstream
Published
2026-10-22T21:17:00Z
Modified
2026-10-31T03:30:05Z
Severity
  • 2.6 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.

References

Affected packages

Ubuntu:Pro:22.04:LTS / python-authlib

Package

Name
python-authlib
Purl
pkg:deb/ubuntu/python-authlib?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.15.4-1
0.15.5-1
0.15.5-1ubuntu0.1~esm1
0.15.5-1ubuntu0.1~esm2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "python3-authlib",
            "binary_version": "0.15.5-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114614.json"

Ubuntu:Pro:24.04:LTS / python-authlib

Package

Name
python-authlib
Purl
pkg:deb/ubuntu/python-authlib?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.2.1-1
1.3.0-1
1.3.0-1ubuntu0.1~esm1
1.3.0-1ubuntu0.1~esm2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "python3-authlib",
            "binary_version": "1.3.0-1ubuntu0.1~esm2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114614.json"

Ubuntu:26.10 / python-authlib

Package

Name
python-authlib
Purl
pkg:deb/ubuntu/python-authlib?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.6.7-1
1.7.2-1
1.7.2-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "python3-authlib",
            "binary_version": "1.7.2-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114614.json"

Ubuntu:Pro:26.04:LTS / python-authlib

Package

Name
python-authlib
Purl
pkg:deb/ubuntu/python-authlib?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.6.0-1
1.6.5-1
1.6.6-1
1.6.7-1
1.6.7-1ubuntu0.1~esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "python3-authlib",
            "binary_version": "1.6.7-1ubuntu0.1~esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-114614.json"