Authlib OAuth 2.0 Authorization Endpoint Unauthenticated Open Redirect Vulnerability

Vulnerability Overview An unauthenticated open redirection vulnerability exists in the Authlib OAuth 2.0 authorization endpoint. When a request uses an unsupported , an attacker can control the , causing the authorization server to redirect to a URL specified by the attacker. Affected Versions Affected Versions: v1.6.6 up to and including the current HEAD v1.6.104-gd6e6ab3f Fixed Versions: 1.6.10, 1.7.1 CVSS Score: 5.4 / 10 Impacted Users: Any users deploying OAuth 2.0 authorization servers with Authlib and utilizing the documented authorization endpoint flow. Remediation Fixed Versions: 1.6.10, 1.7.1 Proof of Concept (POC) Code Observations Additional Impact Unauthenticated Open Redirection: In internet-facing authorization endpoints, attackers can redirect victims to malicious URLs. Phishing and Credential Theft: By abusing the trusted domain of the authorization server as a redirector. Bypassing Domain-Based Whitelists: Whitelists that trust the authorization server host may be bypassed. OAuth Confusion: In the ecosystem, trusted authorization endpoints are expected to reject unregistered values before performing a redirect. Real-World Impact Phishing and Credential Theft: By abusing the trusted domain of the authorization server as a redirector. Bypassing Domain-Based Whitelists: Whitelists that trust the authorization server host may be bypassed. OAuth Confusion: In the ecosystem, trusted authorization endpoints are expected to reject unregistered values before performing a redirect. Conclusion This vulnerability is particularly concerning because the redirection occurs before the existence of the client and the validity of the are established.

Goal Reached Thanks to every supporter — we hit 100%!

Authlib OAuth 2.0 Authorization Endpoint Unauthenticated Open Redirect Vulnerability

More from this source