{"metadata": {"vulnerability": "CVE-2026-114617", "count": 16, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-10-14T09:12:06Z", "date_only": false, "value": "2026-10-14T09:12:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc", "record": "CVE-2026-114617", "field": "creation_timestamp", "uuid": "b984f730-c526-493c-881e-3606a6741d7d", "url": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-21T20:34:25.600Z", "date_only": false, "value": "2026-10-21T20:34:25.600Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-114617", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-22T21:25:31.732Z", "date_only": false, "value": "2026-10-22T21:25:31.732Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114617", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-22T21:25:31.732Z", "date_only": false, "value": "2026-10-22T21:25:31.732Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-114617", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-22T21:35:09.318Z", "date_only": false, "value": "2026-10-22T21:35:09.318409Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117486708894053198", "record": "CVE-2026-114617", "field": "creation_timestamp", "uuid": "133e7b65-3663-49ae-b8c1-a1b1109722fd", "content": "CVE-2026-114617 Authlib: ID token can disable its own nonce validation via the nonce_supported claim Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMixin.parse_id_token() reads the nonce_supported decision from the untrusted ID token being validated and sets the expected nonce to null when that claim is the JSON boolean false. In implicit and hybrid relying parties, or applications that directly accept externally supplied ID tokens, an attacker with a captured validly signed token can bypass the nonce-to-session binding and replay the victim's token into an attacker-controlled session. Plain authorization code flow is not affected, and the token must still pass signature, issuer, and audience validation. OpenIDMixin.parse_id_token() trusts nonce_supported in both authlib/integrations/base_client/sync_openid.py and authlib/integrations/base_client/async_openid.py to disable the expected nonce. This issue is fixed in version 1.9.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-114617https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rchttps://github.com/authlib/authlib/pull/949https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0https://github.com/authlib/authlib/releases/tag/v1.9.0#authlib#CVE_2026_114617#bot", "url": "https://infosec.exchange/users/cve/statuses/117486708894053198"}, {"timestamp": "2026-10-22T22:18:00Z", "date_only": false, "value": "2026-10-22T22:18:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-114617", "record": "UBUNTU-CVE-2026-114617", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-22T22:18:04Z", "date_only": false, "value": "2026-10-22T22:18:04Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C5MF-XMP2-59RC", "record": "GHSA-C5MF-XMP2-59RC", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-22T22:18:04.580Z", "date_only": false, "value": "2026-10-22T22:18:04.580", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114617", "record": "FKIE_CVE-2026-114617", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T14:48:38.535Z", "date_only": false, "value": "2026-10-23T14:48:38.535654Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-114617", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-23T14:48:38.535Z", "date_only": false, "value": "2026-10-23T14:48:38.535654Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114617", "record": "FKIE_CVE-2026-114617", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-23T15:00:16.051Z", "date_only": false, "value": "2026-10-23T15:00:16.051Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-114617", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T15:00:16.051Z", "date_only": false, "value": "2026-10-23T15:00:16.051Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-114617", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T19:34:14.170Z", "date_only": false, "value": "2026-10-23T19:34:14.170", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114617", "record": "FKIE_CVE-2026-114617", "field": "lastModified"}, {"timestamp": "2026-10-27T15:39:13Z", "date_only": false, "value": "2026-10-27T15:39:13Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C5MF-XMP2-59RC", "record": "GHSA-C5MF-XMP2-59RC", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T15:39:13Z", "date_only": false, "value": "2026-10-27T15:39:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C5MF-XMP2-59RC", "record": "GHSA-C5MF-XMP2-59RC", "field": "modified"}, {"timestamp": "2026-10-28T17:50:37Z", "date_only": false, "value": "2026-10-28T17:50:37Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-114617", "record": "UBUNTU-CVE-2026-114617", "field": "modified"}], "metrics": {"as_of": "2026-10-29T11:16:08.254Z", "anchors": {"origin": {"timestamp": "2026-10-22T21:25:31.732Z", "date_only": false, "value": "2026-10-22T21:25:31.732Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114617", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-22T21:25:31.732Z", "date_only": false, "value": "2026-10-22T21:25:31.732Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114617", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-14T09:12:06Z", "date_only": false, "value": "2026-10-14T09:12:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc", "record": "CVE-2026-114617", "field": "creation_timestamp", "uuid": "b984f730-c526-493c-881e-3606a6741d7d", "url": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -735205.732, "hours": -204.22381444444443, "days": -8.50932560185185, "min_seconds": -735205.732, "max_seconds": -735205.732, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-22T21:25:31.732Z", "date_only": false, "value": "2026-10-22T21:25:31.732Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114617", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-14T09:12:06Z", "date_only": false, "value": "2026-10-14T09:12:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc", "record": "CVE-2026-114617", "field": "creation_timestamp", "uuid": "b984f730-c526-493c-881e-3606a6741d7d", "url": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 568236.522492, "hours": 157.84347847, "days": 6.576811602916667, "min_seconds": 568236.522492, "max_seconds": 568236.522492, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-22T21:25:31.732Z", "date_only": false, "value": "2026-10-22T21:25:31.732Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114617", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T11:16:08.254Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 1303442.254492, "hours": 362.06729291444447, "days": 15.086137204768518, "min_seconds": 1303442.254492, "max_seconds": 1303442.254492, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-14T09:12:06Z", "date_only": false, "value": "2026-10-14T09:12:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc", "record": "CVE-2026-114617", "field": "creation_timestamp", "uuid": "b984f730-c526-493c-881e-3606a6741d7d", "url": "https://github.com/authlib/authlib/security/advisories/GHSA-c5mf-xmp2-59rc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T11:16:08.254Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}