CVE-2026-114617
Description
A flaw was found in Authlib. When validating OpenID Connect (OIDC) identity tokens, the library improperly relies on a claim within the incoming token to decide whether to enforce nonce verification, which binds the token to an active session. A remote attacker with a captured, validly signed token can exploit this flaw to bypass session validation and replay the victim's token into an attacker-controlled session, resulting in unauthorized account impersonation.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires specific environmental prerequisites, including the interception of a legitimately signed token and target applications utilizing implicit or hybrid identity flows. Standard authorization code flows, which represent the default and recommended authentication pattern across Red Hat deployments, are not susceptible to this replay weakness. Furthermore, any submitted token must still satisfy cryptographic signature, audience, and issuer validations to be processed.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 4.2 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | Low |
| Integrity Impact | High | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
