#+HashtagPLUS#Hashtag the Web... #Tag your World!
Join

Menu

New post
CVE-2026-114620: CVE-2026-114620: Server-Side Request Forgery in Authlib RFC 9101 JWT-Secured Authorization Request
📰

CVE-2026-114620: CVE-2026-114620: Server-Side Request Forgery in Authlib RFC 9101 JWT-Secured Authorization Request

DEV Community: cybersecurity·CVE Reports·1 day ago
#a4vxWUEQ
#devtocybersecurity#devto#dev#authlib#request
Reading 0:00
15s threshold

CVE-2026-114620: Server-Side Request Forgery in Authlib RFC 9101 JWT-Secured Authorization Request

Vulnerability ID: CVE-2026-114620

CVSS Score: 5.4

Published: 2026-10-27

Authlib versions prior to 1.9.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the RFC 9101 JWT-Secured Authorization Request (JAR) server implementation. The JWTAuthenticationRequest class passes an unauthenticated, client-controlled request_uri parameter directly to the abstract get_request_object() method before applying any destination validation or client registration policies.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Create free accountLog in