{"items":[{"id":"NVI-00008976","kind":"vulnerability","title":"Authlib: ID token can disable its own nonce validation via the nonce_supported claim","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c5mf-xmp2-59rc","CVE-2026-114617"],"plain_summary":"GitHub lists this reviewed advisory for authlib. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-200950e5158f8d1636b2baf924190bb7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T15:39:15.000Z","value":"4.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-56e60c1f37e38cfdca1f6fc7b10be032"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.265%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.18516. Missing scores are unknown.","source_id":"sr-200950e5158f8d1636b2baf924190bb7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-56e60c1f37e38cfdca1f6fc7b10be032","url":"https://github.com/advisories/GHSA-c5mf-xmp2-59rc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c5mf-xmp2-59rc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:51.534Z"},{"id":"sr-200950e5158f8d1636b2baf924190bb7","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-114617","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.374Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-56e60c1f37e38cfdca1f6fc7b10be032"],"technology":"authlib","known_exclusions":[],"conditions_summary":"### Summary\n\n`OpenIDMixin.parse_id_token()` reads the `nonce_supported` claim from the ID token it is validating. When that claim is boolean `false`, the expected nonce is set to `None` and nonce validation is skipped for that token.\n\nAn ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party.\n\nThe code is identical in `authlib/integrations/base_client/sync_openid.py:82-83` and `authlib/integrations/base_client/async_openid.py:84-85`, so all framework integrations are affected. Fixed versions: none; reproduced on 1.8.0 (commit c529a61a).\n  \nPreconditions: the ID token must carry a valid signature and pass `iss` and `aud` validation, and the attacker must be able to supply it to `parse_id_token()`. Authorization code flow is not affected. Implicit and hybrid relying parties, and applications calling `parse_id_token()` directly, are affected.\n\n### Details\n\n## Affected code\n\n`authlib/integrations/base_client/sync_openid.py:80-85`, in `parse_id_token()`:\n\n```python\nclaims = c","public_affected_ranges":["<= 1.8.0"]}],"null_published_at":"2026-10-31T22:27:09.608Z","source_updated_at":"2026-10-27T15:39:15.000Z","source_disclosed_at":"2026-10-27T15:39:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:51.534Z"},{"id":"NVI-00008976","kind":"vulnerability","title":"Authlib: ID token can disable its own nonce validation via the nonce_supported claim","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c5mf-xmp2-59rc","CVE-2026-114617"],"plain_summary":"GitHub lists this reviewed advisory for authlib. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-56e60c1f37e38cfdca1f6fc7b10be032"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-27T15:39:15.000Z","value":"4.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-56e60c1f37e38cfdca1f6fc7b10be032"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-56e60c1f37e38cfdca1f6fc7b10be032","url":"https://github.com/advisories/GHSA-c5mf-xmp2-59rc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c5mf-xmp2-59rc","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:51.534Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-56e60c1f37e38cfdca1f6fc7b10be032"],"technology":"authlib","known_exclusions":[],"conditions_summary":"### Summary\n\n`OpenIDMixin.parse_id_token()` reads the `nonce_supported` claim from the ID token it is validating. When that claim is boolean `false`, the expected nonce is set to `None` and nonce validation is skipped for that token.\n\nAn ID token that carries this claim is therefore accepted in a session whose nonce does not match. A captured, validly signed ID token belonging to a victim can be replayed into an attacker-controlled session, authenticating the attacker as the victim at the relying party.\n\nThe code is identical in `authlib/integrations/base_client/sync_openid.py:82-83` and `authlib/integrations/base_client/async_openid.py:84-85`, so all framework integrations are affected. Fixed versions: none; reproduced on 1.8.0 (commit c529a61a).\n  \nPreconditions: the ID token must carry a valid signature and pass `iss` and `aud` validation, and the attacker must be able to supply it to `parse_id_token()`. Authorization code flow is not affected. Implicit and hybrid relying parties, and applications calling `parse_id_token()` directly, are affected.\n\n### Details\n\n## Affected code\n\n`authlib/integrations/base_client/sync_openid.py:80-85`, in `parse_id_token()`:\n\n```python\nclaims = c","public_affected_ranges":["<= 1.8.0"]}],"null_published_at":"2026-10-31T22:13:27.125Z","source_updated_at":"2026-10-27T15:39:15.000Z","source_disclosed_at":"2026-10-27T15:39:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:51.534Z"}],"next_cursor":null,"snapshot_revision":"42594"}