CVE-2026-104056CWE-345CWE-346CWE-829

CVE-2026-104056

Critical · published October 1, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00167 · 5.7th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-346 · Origin Validation Error; CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2026-10-01T23:17Z
References (2)
https://uziii2208.github.io/post/cve-2026-104056/ · [email protected]https://uziii2208.github.io/post/cve-2026-104056/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 18:03Z
    CVE-2026-104056
    cvelistv5