Vulnerability-Lookup

CVE-2025-68158 (GCVE-0-2025-68158)

Vulnerability from cvelistv5 – Published: 2026-01-08 17:58 – Updated: 2026-01-08 18:20

Title

Authlib: 1-click Account Takeover

Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.

Severity ?

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M

References

URL

Tags

	https://github.com/authlib/authlib/security/advis…	x_refsource_CONFIRM
	https://github.com/authlib/authlib/commit/2808378…	x_refsource_MISC
	https://github.com/authlib/authlib/commit/7974f45…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	authlib	authlib	Affected: < 1.6.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68158",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T18:19:47.500891Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-08T18:20:43.016Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller\u2019s session altogether. This issue has been patched in version 1.6.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-08T17:58:17.724Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228"
        }
      ],
      "source": {
        "advisory": "GHSA-fg6f-75jq-6523",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib: 1-click Account Takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68158",
    "datePublished": "2026-01-08T17:58:17.724Z",
    "dateReserved": "2025-12-15T23:02:17.604Z",
    "dateUpdated": "2026-01-08T18:20:43.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68158\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-01-08T18:15:59.060\",\"lastModified\":\"2026-01-08T19:15:58.377\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller\u2019s session altogether. This issue has been patched in version 1.6.6.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"references\":[{\"url\":\"https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-68158\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-08T18:19:47.500891Z\"}}}], \"references\": [{\"url\": \"https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-08T18:19:50.211Z\"}}], \"cna\": {\"title\": \"Authlib: 1-click Account Takeover\", \"source\": {\"advisory\": \"GHSA-fg6f-75jq-6523\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"authlib\", \"product\": \"authlib\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.6.6\"}]}], \"references\": [{\"url\": \"https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523\", \"name\": \"https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489\", \"name\": \"https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228\", \"name\": \"https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller\\u2019s session altogether. This issue has been patched in version 1.6.6.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-352\", \"description\": \"CWE-352: Cross-Site Request Forgery (CSRF)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-01-08T17:58:17.724Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-68158\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-08T18:20:43.016Z\", \"dateReserved\": \"2025-12-15T23:02:17.604Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-01-08T17:58:17.724Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-FG6F-75JQ-6523

Vulnerability from github – Published: 2026-01-08 22:40 – Updated: 2026-01-09 03:12

Summary

Authlib has 1-click Account Takeover vulnerability

Details

I am writing to you from the Security Labs team at Snyk to report a security issue affecting Authlib, which we identified during a recent research project.

We have identified a vulnerability that can result in a 1-click Account Takeover in applications that use the Authlib library. (5.7 CVSS v3: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)

Description

Cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. [1][2]

    def _get_cache_data(self, key):
        value = self.cache.get(key)
        if not value:
            return None
        try:
            return json.loads(value)
        except (TypeError, ValueError):
            return None
[snip]
    def get_state_data(self, session, state):
        key = f"_state_{self.name}_{state}"
        if self.cache:
            value = self._get_cache_data(key)
        else:
            value = session.get(key)
        if value:
            return value.get("data")
        return None

authlib/integrations/base_client/framework_integration.py:12-41

Retrieval in authorize_access_token therefore succeeds for whichever browser presents that opaque value, and the token exchange proceeds with the attacker’s authorization code. [3]

    def authorize_access_token(self, **kwargs):
        """Fetch access token in one step.

        :return: A token dict.
        """
        params = request.args.to_dict(flat=True)
        state = params.get("oauth_token")
        if not state:
            raise OAuthError(description='Missing "oauth_token" parameter')

        data = self.framework.get_state_data(session, state)
        if not data:
            raise OAuthError(description='Missing "request_token" in temporary data')

        params["request_token"] = data["request_token"]
        params.update(kwargs)
        self.framework.clear_state_data(session, state)
        token = self.fetch_access_token(**params)
        self.token = token
        return token

authlib/integrations/flask_client/apps.py:57-76

This opens up the avenue for Login CSRF for apps that use the cache-backed storage. Depending on the dependent app’s implementation (whether it somehow links accounts in the case of a login CSRF), this could lead to account takeover.

[1] https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L35

[2] https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/base_client/framework_integration.py#L33

[3] https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L57

Proof of Concept

Let’s think of an app - AwesomeAuthlibApp. Let’s assume that the AwesomeAuthlibApp has internal logic that, when an already logged-in user performs a callback request, links the newly provided SSO identity to the already existing user that made the request.

Then, an attacker can get account takeover inside the app by performing the following actions:

1. They start an SSO OAuth flow, but stop it right before making the callback call to AwesomeAuthlibApp;
2. The attacker tricks a logged-in user (via phishing, a drive-by attack, etc.) to perform a GET request with the attacker's state value and grant code to the AwesomeAuthlibApp callback. Because Authlib doesn’t check whether the state token is linked to the session performing the callback, the callback is processed, the grant code is sent to the provider, and the account linking takes place.

After the GET request is performed, the attacker's SSO account is linked with the victim's AwesomeAuthlibApp account permanently.

Suggested Fix

Per the OAuth RFC [4], the state should be tied to the user’s session to stop exactly such scenarios. One straightforward method of mitigating this issue is to keep storing the state in the session even when caching.

Another method would be to hash the session ID (or another per-user secret from the session) into the cache key. This way, the state will be stored inside the cache, but it is still linked to the session of the user that initiated the OAuth flow.

[4] https://www.rfc-editor.org/rfc/rfc6749#section-10.12

Severity ?

5.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "authlib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68158"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-08T22:40:56Z",
    "nvd_published_at": "2026-01-08T18:15:59Z",
    "severity": "MODERATE"
  },
  "details": "I am writing to you from the Security Labs team at Snyk to report a security issue affecting Authlib, which we identified during a recent research project.\n\nWe have identified a vulnerability that can result in a 1-click Account Takeover in applications that use the Authlib library. (5.7 CVSS v3: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)\n\n**Description**\n\nCache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, `FrameworkIntegration.set_state_data` writes the entire state blob under `_state_{app}_{state},` and `get_state_data` ignores the caller\u2019s session altogether. \\[1\\]\\[2\\]\n\n```py\n    def _get_cache_data(self, key):\n        value = self.cache.get(key)\n        if not value:\n            return None\n        try:\n            return json.loads(value)\n        except (TypeError, ValueError):\n            return None\n[snip]\n    def get_state_data(self, session, state):\n        key = f\"_state_{self.name}_{state}\"\n        if self.cache:\n            value = self._get_cache_data(key)\n        else:\n            value = session.get(key)\n        if value:\n            return value.get(\"data\")\n        return None\n```\n\n*authlib/integrations/base\\_client/framework\\_integration.py:12-41*\n\nRetrieval in authorize\\_access\\_token therefore succeeds for whichever browser presents that opaque value, and the token exchange proceeds with the attacker\u2019s authorization code. \\[3\\]\n\n```py\n    def authorize_access_token(self, **kwargs):\n        \"\"\"Fetch access token in one step.\n\n        :return: A token dict.\n        \"\"\"\n        params = request.args.to_dict(flat=True)\n        state = params.get(\"oauth_token\")\n        if not state:\n            raise OAuthError(description=\u0027Missing \"oauth_token\" parameter\u0027)\n\n        data = self.framework.get_state_data(session, state)\n        if not data:\n            raise OAuthError(description=\u0027Missing \"request_token\" in temporary data\u0027)\n\n        params[\"request_token\"] = data[\"request_token\"]\n        params.update(kwargs)\n        self.framework.clear_state_data(session, state)\n        token = self.fetch_access_token(**params)\n        self.token = token\n        return token\n```\n\n*authlib/integrations/flask\\_client/apps.py:57-76*\n\nThis opens up the avenue for Login CSRF for apps that use the cache-backed storage. Depending on the dependent app\u2019s implementation (whether it somehow links accounts in the case of a login CSRF), this could lead to account takeover.\n\n\\[1\\] [https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask\\_client/apps.py\\#L35](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L35)\n\n\\[2\\] [https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/base\\_client/framework\\_integration.py\\#L33](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/base_client/framework_integration.py#L33)\n\n\\[3\\] [https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask\\_client/apps.py\\#L57](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L57)\n\n**Proof of Concept**\n\nLet\u2019s think of an app \\- AwesomeAuthlibApp. Let\u2019s assume that the AwesomeAuthlibApp has internal logic that, when an already logged-in user performs a `callback` request, links the newly provided SSO identity to the already existing user that made the request.\n\nThen, an attacker can get account takeover inside the app by performing the following actions:\n\n1\\. They start an SSO OAuth flow, but stop it right before making the callback call to AwesomeAuthlibApp;  \n2\\. The attacker tricks a logged-in user (via phishing, a drive-by attack, etc.) to perform a GET request with the attacker\u0027s state value and grant code to the AwesomeAuthlibApp callback. Because Authlib doesn\u2019t check whether the state token is linked to the session performing the callback, the callback is processed, the grant code is sent to the provider, and the account linking takes place.\n\nAfter the GET request is performed, the attacker\u0027s SSO account is linked with the victim\u0027s AwesomeAuthlibApp account permanently.\n\n**Suggested Fix**\n\nPer the OAuth RFC \\[4\\], the state should be tied to the user\u2019s session to stop exactly such scenarios. One straightforward method of mitigating this issue is to keep storing the state in the session even when caching.\n\nAnother method would be to hash the session ID (or another per-user secret from the session) into the cache key. This way, the state will be stored inside the cache, but it is still linked to the session of the user that initiated the OAuth flow.\n\n[4] https://www.rfc-editor.org/rfc/rfc6749#section-10.12",
  "id": "GHSA-fg6f-75jq-6523",
  "modified": "2026-01-09T03:12:03Z",
  "published": "2026-01-08T22:40:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68158"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489"
    },
    {
      "type": "WEB",
      "url": "https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/authlib/authlib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authlib has 1-click Account Takeover vulnerability"
}

FKIE_CVE-2025-68158

Vulnerability from fkie_nvd - Published: 2026-01-08 18:15 - Updated: 2026-01-08 19:15

Severity ?

5.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489
	security-advisories@github.com	https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228
	security-advisories@github.com	https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller\u2019s session altogether. This issue has been patched in version 1.6.6."
    }
  ],
  "id": "CVE-2025-68158",
  "lastModified": "2026-01-08T19:15:58.377",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-08T18:15:59.060",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-68158 (GCVE-0-2025-68158)

GHSA-FG6F-75JQ-6523

FKIE_CVE-2025-68158

Tags

Sightings

Nomenclature