High 8.8Published Jan 8, 2026

CVE-2025-68158Authlib is a Python library which builds OAuth and OpenID Connect servers.

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects authlib. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for authlib

Exploited in the last 30 days

Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.

CVSS: 8.8 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-352
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

authlib authlib authlib:authlib	before 1.6.6	NVD

References

https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489patch
https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228patch
https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523exploit, vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.