{"metadata": {"vulnerability": "CVE-2026-114620", "count": 14, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-14T09:21:49Z", "date_only": false, "value": "2026-10-14T09:21:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8", "record": "CVE-2026-114620", "field": "creation_timestamp", "uuid": "e1e46de1-1a77-4dcc-b37d-5528b90b6d1b", "url": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-21T20:34:25.600Z", "date_only": false, "value": "2026-10-21T20:34:25.600Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-114620", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-22T21:34:11.909Z", "date_only": false, "value": "2026-10-22T21:34:11.909Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114620", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-22T21:34:11.909Z", "date_only": false, "value": "2026-10-22T21:34:11.909Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-114620", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-22T21:34:11.909Z", "date_only": false, "value": "2026-10-22T21:34:11.909Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-114620", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-22T21:45:51.219Z", "date_only": false, "value": "2026-10-22T21:45:51.219605Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117486750968926786", "record": "CVE-2026-114620", "field": "creation_timestamp", "uuid": "53580f84-b53d-4679-9ad5-6710a8a281e5", "content": "CVE-2026-114620 Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-114620https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8https://github.com/authlib/authlib/pull/949https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0https://github.com/authlib/authlib/commit/891e3f10ae5989176211f8be35dcc7cd40aa92c6https://github.com/authlib/authlib/releases/tag/v1.9.0#authlib#CVE_2026_114620#bot", "url": "https://infosec.exchange/users/cve/statuses/117486750968926786"}, {"timestamp": "2026-10-22T22:18:00Z", "date_only": false, "value": "2026-10-22T22:18:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-114620", "record": "UBUNTU-CVE-2026-114620", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-22T22:18:05Z", "date_only": false, "value": "2026-10-22T22:18:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X4RV-C3WX-4CR8", "record": "GHSA-X4RV-C3WX-4CR8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-22T22:18:05.090Z", "date_only": false, "value": "2026-10-22T22:18:05.090", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114620", "record": "FKIE_CVE-2026-114620", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T19:34:14.170Z", "date_only": false, "value": "2026-10-23T19:34:14.170", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114620", "record": "FKIE_CVE-2026-114620", "field": "lastModified"}, {"timestamp": "2026-10-27T15:39:18Z", "date_only": false, "value": "2026-10-27T15:39:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X4RV-C3WX-4CR8", "record": "GHSA-X4RV-C3WX-4CR8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T15:39:18Z", "date_only": false, "value": "2026-10-27T15:39:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X4RV-C3WX-4CR8", "record": "GHSA-X4RV-C3WX-4CR8", "field": "modified"}, {"timestamp": "2026-10-27T16:30:50Z", "date_only": false, "value": "2026-10-27T16:30:50.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/84187153c1f6a2bc9dfc42e9734b420d", "record": "CVE-2026-114620", "field": "creation_timestamp", "uuid": "9e999749-15f1-4562-b89b-1213578e0b20", "content": "# CVE-2026-114620: CVE-2026-114620: Server-Side Request Forgery in Authlib RFC 9101 JWT-Secured Authorization Request\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-10-27\n> **Full Report:** https://cvereports.com/reports/CVE-2026-114620\n\n## Summary\nAuthlib versions prior to 1.9.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the RFC 9101 JWT-Secured Authorization Request (JAR) server implementation. The JWTAuthenticationRequest class passes an unauthenticated, client-controlled request_uri parameter directly to the abstract get_request_object() method before applying any destination validation or client registration policies. Because the official documentation previously recommended implementing this hook as an unrestricted HTTP fetch, deployments following those guidelines allow remote attackers possessing a valid public client_id to trigger outbound network requests to internal services and infer fetch outcomes via error response variations.\n\n## TL;DR\nAuthlib < 1.9.0 passes unauthenticated `request_uri` parameters to `get_request_object()` without prior validation in its RFC 9101 implementation. If downstream applications implement this method using unrestricted HTTP fetches as shown in legacy documentation, attackers with a valid `client_id` can perform blind SSRF and internal network reconnaissance via error response differentiation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: Server-Side Request Forgery (CWE-918)\n- **Affected Component**: authlib.oauth2.rfc9101.JWTAuthenticationRequest\n- **Attack Vector**: Network (Unauthenticated HTTP GET to OAuth Authorization Endpoint)\n- **CVSS v3.1 Score**: 5.4 Medium (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)\n- **EPSS Score**: 0.29% (21.46th Percentile)\n- **Impact**: Blind SSRF, Internal Port/Service Scanning via Error Oracle\n- **Exploit Status**: Proof-of-Concept (Unit Test Suite)\n- **Patched Version**: authlib 1.9.0\n\n## Affected Systems\n\n- Authlib (Python package)\n- **authlib**: < 1.9.0 (Fixed in: `1.9.0`)\n\n## Mitigation\n\n- Upgrade Authlib to version 1.9.0 or later to enforce pre-fetch URI validation.\n- Require pre-registration of `request_uri` values per OAuth client and validate exact string matches before initiating any network connection.\n- Disable `request_uri` support (`support_request_uri=False`) if clients can pass JAR payloads by value using the `request` parameter.\n- Harden the outbound HTTP client in `get_request_object()` by enforcing HTTPS, disabling redirects, restricting resolved IP addresses to public routable space, and enforcing strict timeouts and response size limits.\n\n**Remediation Steps:**\n1. Update package dependencies (`pip install 'authlib>=1.9.0'`).\n2. Locate all subclasses of `authlib.oauth2.rfc9101.JWTAuthenticationRequest` in the application codebase.\n3. Implement the `validate_request_uri(self, request_uri: str, client: ClientMixin) -> bool` method to verify that `request_uri` exactly matches an entry in the client's pre-registered `request_uris` allowlist.\n4. For OpenID Connect servers, migrate to `OpenIDJWTAuthenticationRequest` and configure `require_request_uri_registration` to `True` in server metadata.\n5. Audit `get_request_object()` to ensure it uses `allow_redirects=False` (or `follow_redirects=False`), enforces short connection/read timeouts, limits response payload size, and blocks connections to private, loopback, and link-local IP addresses.\n\n## References\n\n- [GitHub Security Advisory GHSA-x4rv-c3wx-4cr8](https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8)\n- [NVD - CVE-2026-114620 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-114620)\n- [CVE.org Record: CVE-2026-114620](https://www.cve.org/CVERecord?id=CVE-2026-114620)\n- [Authlib Pull Request #949](https://github.com/authlib/authlib/pull/949)\n- [Fix Commit 6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0](https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0)\n- [Fix Commit 891e3f10ae5989176211f8be35dcc7cd40aa92c6](https://github.com/authlib/authlib/commit/891e3f10ae5989176211f8be35dcc7cd40aa92c6)\n- [Authlib Release v1.9.0](https://github.com/authlib/authlib/releases/tag/v1.9.0)\n- [CVE List V5 JSON Record](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114620.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-114620) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/84187153c1f6a2bc9dfc42e9734b420d"}, {"timestamp": "2026-10-28T17:50:37Z", "date_only": false, "value": "2026-10-28T17:50:37Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-114620", "record": "UBUNTU-CVE-2026-114620", "field": "modified"}], "metrics": {"as_of": "2026-10-29T05:14:06.592Z", "anchors": {"origin": {"timestamp": "2026-10-22T21:34:11.909Z", "date_only": false, "value": "2026-10-22T21:34:11.909Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114620", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-22T21:34:11.909Z", "date_only": false, "value": "2026-10-22T21:34:11.909Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114620", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-14T09:21:49Z", "date_only": false, "value": "2026-10-14T09:21:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8", "record": "CVE-2026-114620", "field": "creation_timestamp", "uuid": "e1e46de1-1a77-4dcc-b37d-5528b90b6d1b", "url": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -735142.909, "hours": -204.2063636111111, "days": -8.508598483796296, "min_seconds": -735142.909, "max_seconds": -735142.909, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-22T21:34:11.909Z", "date_only": false, "value": "2026-10-22T21:34:11.909Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114620", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-14T09:21:49Z", "date_only": false, "value": "2026-10-14T09:21:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8", "record": "CVE-2026-114620", "field": "creation_timestamp", "uuid": "e1e46de1-1a77-4dcc-b37d-5528b90b6d1b", "url": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 545994.683237, "hours": 151.66518978805556, "days": 6.3193829078356485, "min_seconds": 545994.683237, "max_seconds": 545994.683237, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-22T21:34:11.909Z", "date_only": false, "value": "2026-10-22T21:34:11.909Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114620", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T05:14:06.592Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 1281137.592237, "hours": 355.87155339916666, "days": 14.827981391631942, "min_seconds": 1281137.592237, "max_seconds": 1281137.592237, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-14T09:21:49Z", "date_only": false, "value": "2026-10-14T09:21:49.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8", "record": "CVE-2026-114620", "field": "creation_timestamp", "uuid": "e1e46de1-1a77-4dcc-b37d-5528b90b6d1b", "url": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-29T05:14:06.592Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}