Description (CNA)
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Authlib / Authlib | affected 1.7.2 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.