CVE-2026-116672: CVE-2026-116672: Authorization Bypass in Authlib RFC 7592 Client Configuration Endpoint

The framework fails to verify that the presented registration access token belongs to the target client specified in the request, and the official reference implementations for authenticate_client and check_permission omit token-to-client binding checks. Consequently, an authenticated client holding any valid registration access token can read, modify, or delete the registration metadata of arbitrary clients on the authorization server. TL;DR An Insecure Direct Object Reference (IDOR) flaw in Authlib's RFC 7592 ClientConfigurationEndpoint allows any client with a valid registration access token to read, modify, or delete other clients' OAuth 2.0 configurations, including client secrets and redirect URIs.

Upgrading to Authlib 1.9.1 enforces mandatory token-client binding within the endpoint processing pipeline. ⚠️ Exploit Status: POC Technical Details Vulnerability Type: Insecure Direct Object Reference (IDOR) / Authorization Bypass CWE ID: CWE-639 / CWE-1188 CVSS v3.1 Score: 8.8 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Affected Component: authlib.oauth2.rfc7592. ClientConfigurationEndpoint Affected Versions: >= 0.15, < 1.9.1 Patched Version: 1.9.1 EPSS Score: 0.27% (19.83rd percentile) CISA KEV Status: Not Listed Affected Systems Authlib (PyPI package authlib) Authlib: >= 0.15, < 1.9.1 (Fixed in: 1.9.1) Code Analysis Commit: 1bd2a31 The client configuration endpoint rejects a registration access token issued to another client. The documentation examples read the client_id from the endpoint URL instead of the request body. @@ -39,6 +39,11 @@ def create_configuration_response(self, request): status_code=401, description="The client does not exist on this server." ) + # The registration access token is only valid for the client it was + # issued to. + if not token.check_client(client): + raise AccessDeniedError() + if not self.check_permission(client, request): Exploit Details GitHub: Official patch commit containing regression test cases demonstrating cross-client read, update, and delete requests.

Mitigation Strategies Upgrade Authlib to version 1.9.1 or later to enable framework-level enforcement of token-to-client binding in ClientConfigurationEndpoint. Enforce explicit verification between request.credential (the registration access token) and the target client record inside check_permission. Ensure the token model returned by authenticate_token properly subclasses TokenMixin and implements strict client_id matching in check_client.

Audit access logs on RFC 7592 client configuration endpoints for a single bearer token accessing multiple distinct client_id paths. Remediation Steps: Update the Python environment dependency to Authlib >= 1.9.1 via pip: pip install --upgrade "authlib>=1.9.1". Inspect the custom ClientConfigurationEndpoint subclass to confirm authenticate_token returns a token instance implementing check_client(client).

Update authenticate_client in any custom ClientConfigurationEndpoint subclass to extract client_id from the URL path rather than exclusively from the request JSON payload. Add unit and integration tests verifying that GET, PUT, and DELETE requests using a registration access token issued to another client fail with HTTP 400 access_denied. References GitHub Security Advisory GHSA-c73q-w75p-j82v Authlib Fix Commit 1bd2a313492ce0a4d0571c150730907aa3fc91ff Authlib v1.9.1 Release Notes NVD - CVE-2026-116672 CVE.org Record - CVE-2026-116672 CVE List V5 JSON Record - CVE-2026-116672 Wiz Vulnerability Database - CVE-2026-116672 Read the full report for CVE-2026-116672 on our website for more details including interactive diagrams and full exploit analysis.