CVE-2026-41425: authlib Cross-Site Request Forgery (CSRF)
CVSS: 5.4v3.1MediumAnalyzed
AliasesGHSA-jj8c-mmj3-mmgvPYSEC-2026-25UBUNTU-CVE-2026-41425DEBIAN-CVE-2026-41425CGA-6ch4-j43c-86gxCGA-6jx5-rw7q-wfv4CGA-7g94-jpmr-239xCGA-cc9q-52c8-36cqCGA-fg3x-gx7c-m3v8CGA-h39f-cgqr-jc8fCGA-pfrc-vq67-vf9cCGA-w5v6-hff2-978mCGA-2j8j-2pc7-j555CGA-4798-wj4f-m9q9CGA-7p33-68c8-68fpCGA-9rwv-qc2j-pg6pCGA-c372-23xm-6j22CGA-q872-96gp-2m8wCGA-qrmc-w694-22c6CGA-rw82-c9j2-qvf4
Published 24-04-2026Last modified 27-04-2026
Vulnerability summary
CVE-2026-41425 is a medium (CVSS 5.4) Cross-Site Request Forgery (CSRF) vulnerability in authlib. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.7% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)EPSS score
0.14%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 24-04-2026PublishedVulnerability first disclosed.
- 27-04-2026Last modifiedVulnerability information updated.
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability is fixed in 1.6.11.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 5.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.03 pp
From 0.11% on 19-09-2026
19-09-202619-10-2026
EPSS score0.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAuthlib
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard7 products
- airflow-2< 2.11.2-r8
- airflow-3< 3.2.1-r0
- datahub-ingestion< 1.5.0.3-r0
- datahub-ingestion-fips< 1.5.0.1-r2
- mlflow< 3.11.1-r0 | < 3.16.0-r0
Wolfi3 products
- airflow-3< 3.2.1-r0
- mlflow< 3.11.1-r0 | < 3.16.0-r0
- open-webui< 0.8.12-r4 | < 0.9.2-r0
Authlib1 product
- authlib< 1.6.11
Debian1 product
- python-authlib< 1.2.0-1+deb12u2 | All versions (No fix recorded) | < 1.7.0-1
PyPI1 product
- authlib< 1.6.11
Ubuntu1 product
- python-authlib< 1.3.0-1ubuntu0.1~esm2 | All versions (No fix recorded) | < 1.6.7-1ubuntu0.1~esm1
6 vendors · 14 products
References
9 links- github.com/authlib/authlib/security/advisories/GHSA-jj8c-mmj3-mmgvX Refsource CONFIRMWEBEVIDENCEREPORTAdvisoryExploitVendor Advisory
- github.com/authlib/authlibPACKAGE
