CVE-2026-114620
Description
A flaw was found in Authlib. A remote attacker can trigger Server-Side Request Forgery (SSRF) by submitting an unvalidated request URI parameter in an authorization request. Because the library forwards client-supplied addresses to internal retrieval handlers without enforcing destination policies or allowlists, the server may issue requests to unintended network locations. This issue can allow an attacker to probe internal network services and interact with sensitive endpoints, such as cloud metadata services.
Statement
This vulnerability is rated as Moderate impact because triggering the flaw requires an authorization deployment to explicitly implement the optional RFC 9101 JWT-Secured Authorization Request extension with an unrestricted outbound network retrieval hook. Exploitation is further constrained because response payloads are not directly reflected to the remote caller, limiting the practical threat to blind server-side request forgery, host probing, and timing analysis against internal endpoints. Applications that do not implement outbound URI fetching or that enforce strict destination controls in their custom handlers remain unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 5.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
