{"id":"CVE-2025-68158","aliases":["DEBIAN-CVE-2025-68158","EUVD-2025-206267","GHSA-fg6f-75jq-6523","PYSEC-2026-1201","SUSE-SU-2026:0828-1","UBUNTU-CVE-2025-68158","USN-8065-1","openSUSE-SU-2026:10034-1","openSUSE-SU-2026:20257-1"],"status":"published","title":"Authlib: 1-click Account Takeover","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00272,"percentile":0.19753,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-01-08T17:58:17Z","modified":"2026-10-28T20:16:38Z","fixes":[{"ecosystem":"PyPI","package":"authlib","fixed_in":["1.6.6"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-authlib","fixed_in":["1.2.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-authlib","fixed_in":["1.6.0-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-authlib","fixed_in":["1.6.6-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-Authlib","fixed_in":["1.3.1-150600.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-Authlib","fixed_in":["1.3.1-150600.3.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-authlib","fixed_in":["1.3.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Authlib","fixed_in":["1.6.6-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-Authlib","fixed_in":["1.5.2-bp160.2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.6.5"},{"fixed":"1.6.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1+deb12u1"}]}],"versions":["1.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1+deb13u1"}]}],"versions":["1.6.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}],"versions":["1.6.0-1","1.6.1-1","1.6.3-1","1.6.4-1","1.6.5-1"]},{"source":"osv","ecosystem":"PyPI","package":"authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.6.6"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5"]},{"source":"osv","ecosystem":"PyPI","package":"authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.6.6"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-Authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-150600.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-150600.3.14.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1ubuntu0.1~esm1"}]}],"versions":["1.2.1-1","1.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-1","1.5.2-1","1.6.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.5-1ubuntu0.1~esm1"}]}],"versions":["0.15.4-1","0.15.5-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1ubuntu0.1~esm1"}]}],"versions":["1.2.1-1","1.3.0-1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-Authlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-bp160.2.1"}]}]}],"products":[{"vendor":"authlib","product":"authlib"}],"references":[{"url":"https://github.com/authlib/authlib/security/advisories/GHSA-fg6f-75jq-6523","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/authlib/authlib/commit/2808378611dd6fb2532b189a9087877d8f0c0489","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/authlib/authlib/commit/7974f45e4d7492ab5f527577677f2770ce423228","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68158","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fg6f-75jq-6523","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68158.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68158","tags":["advisory"]},{"url":"https://github.com/authlib/authlib","tags":["package"]},{"url":"https://pypi.org/project/authlib","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260828-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256414","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68158","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-68158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68158","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8065-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-37568","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-59420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-61920","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-62706","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-68158","title":"Authlib: 1-click Account Takeover","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.","status":"published","published":"2026-01-08T17:58:17.724Z","modified":"2026-03-30T12:20:39.207Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-206267","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.","status":"published","published":"2026-01-08T17:58:17Z","modified":"2026-03-30T12:20:39Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:26.376466Z"}],"ghsa":[{"id":"GHSA-fg6f-75jq-6523","title":"Authlib has 1-click Account Takeover vulnerability","description":"# Security Advisory: Cache-Backed State Storage CSRF in Authlib\n\nThe Security Labs team at Snyk has reported a security issue affecting Authlib, identified during a recent research project.\n\nThe Snyk Security Labs team has identified a vulnerability that can result in a one-click account takeover in applications that utilize the Authlib library.\n\n## Description\n\nCache-backed state/request-token storage is not tied to the initiating user session, making CSRF possible for any attacker that possesses a valid state value (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, `FrameworkIntegration.set_state_data` writes the entire state blob under `_state_{app}_{state}`, and `get_state_data` disregards the caller's session entirely. [1][2]\n\n```py\n    def _get_cache_data(self, key):\n        value = self.cache.get(key)\n        if not value:\n            return None\n        try:\n            return json.loads(value)\n        except (TypeError, ValueError):\n            return None\n[snip]\n    def get_state_data(self, session, state):\n        key = f\"_state_{self.name}_{state}\"\n        if self.cache:\n            value = self._get_cache_data(key)\n        else:\n            value = session.get(key)\n        if value:\n            return value.get(\"data\")\n        return None\n```\n\n*authlib/integrations/base_client/framework_integration.py:12-41*\n\nRetrieval in `authorize_access_token` therefore succeeds for whichever browser presents that opaque value, and the token exchange proceeds with the attacker's authorization code. [3]\n\n```py\n    def authorize_access_token(self, **kwargs):\n        \"\"\"Fetch access token in one step.\n\n        :return: A token dict.\n        \"\"\"\n        params = request.args.to_dict(flat=True)\n        state = params.get(\"oauth_token\")\n        if not state:\n            raise OAuthError(description='Missing \"oauth_token\" parameter')\n\n        data = self.framework.get_state_data(session, state)\n        if not data:\n            raise OAuthError(description='Missing \"request_token\" in temporary data')\n\n        params[\"request_token\"] = data[\"request_token\"]\n        params.update(kwargs)\n        self.framework.clear_state_data(session, state)\n        token = self.fetch_access_token(**params)\n        self.token = token\n        return token\n```\n\n*authlib/integrations/flask_client/apps.py:57-76*\n\nThis opens up an avenue for Login CSRF in applications that use cache-backed storage. Depending on the dependent application's implementation (e.g., whether it links accounts in the event of a login CSRF), this could lead to account takeover.\n\n## Proof of Concept\n\nConsider a hypothetical application — AwesomeAuthlibApp. Assume that AwesomeAuthlibApp contains internal logic such that, when an already authenticated user performs a `callback` request, the application links the newly provided SSO identity to the existing user account associated with that request.\n\nUnder these conditions, an attacker can achieve account takeover within the application by performing the following actions:\n\n1. The attacker initiates an SSO OAuth flow but halts the process immediately before the callback request is made to AwesomeAuthlibApp.\n2. The attacker then induces a logged-in user (via phishing, a drive-by attack, or similar means) to perform a GET request containing the attacker's state value and authorization code to the AwesomeAuthlibApp callback endpoint. Because Authlib does not verify whether the state token is bound to the session performing the callback, the callback is processed, the authorization code is sent to the provider, and the account linking proceeds.\n\nOnce the GET request is executed, the attacker's SSO account becomes permanently linked to the victim's AwesomeAuthlibApp account.\n\n## Suggested Fix\n\nPer the OAuth RFC [4], the state parameter should be tied to the user's session to prevent exactly such scenarios. One straightforward method of mitigating this issue is to continue storing the state in the session even when caching is enabled.\n\nAn alternative approach would be to hash the session ID (or another per-user secret derived from the session) into the cache key. This ensures the state remains stored in the cache while still being bound to the session of the user that initiated the OAuth flow.\n\n## Resources\n\n- [1] [flask_client/apps.py#L35](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L35)\n- [2] [base_client/framework_integration.py#L33](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/base_client/framework_integration.py#L33)\n- [3] [flask_client/apps.py#L57](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L57)\n- [4] [RFC 6749 §10.12](https://www.rfc-editor.org/rfc/rfc6749#section-10.12)","status":"published","published":"2026-01-08T22:40:56Z","modified":"2026-03-30T12:20:15Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:39:44.97342Z"}],"nvd":[{"id":"CVE-2025-68158","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.","status":"published","published":"2026-01-08T18:15:59.06Z","modified":"2026-10-14T17:10:00.21Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:56.616231Z"}],"osv":[{"id":"CVE-2025-68158","title":"Authlib: 1-click Account Takeover","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.","status":"published","published":"2026-01-08T17:58:17.724Z","modified":"2026-10-28T02:30:21.833314605Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68158","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.","status":"published","published":"2026-01-08T18:15:59.06Z","modified":"2026-10-15T09:47:26.693096605Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-fg6f-75jq-6523","title":"Authlib has 1-click Account Takeover vulnerability","description":"# Security Advisory: Cache-Backed State Storage CSRF in Authlib\n\nThe Security Labs team at Snyk has reported a security issue affecting Authlib, identified during a recent research project.\n\nThe Snyk Security Labs team has identified a vulnerability that can result in a one-click account takeover in applications that utilize the Authlib library.\n\n## Description\n\nCache-backed state/request-token storage is not tied to the initiating user session, making CSRF possible for any attacker that possesses a valid state value (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, `FrameworkIntegration.set_state_data` writes the entire state blob under `_state_{app}_{state}`, and `get_state_data` disregards the caller's session entirely. [1][2]\n\n```py\n    def _get_cache_data(self, key):\n        value = self.cache.get(key)\n        if not value:\n            return None\n        try:\n            return json.loads(value)\n        except (TypeError, ValueError):\n            return None\n[snip]\n    def get_state_data(self, session, state):\n        key = f\"_state_{self.name}_{state}\"\n        if self.cache:\n            value = self._get_cache_data(key)\n        else:\n            value = session.get(key)\n        if value:\n            return value.get(\"data\")\n        return None\n```\n\n*authlib/integrations/base_client/framework_integration.py:12-41*\n\nRetrieval in `authorize_access_token` therefore succeeds for whichever browser presents that opaque value, and the token exchange proceeds with the attacker's authorization code. [3]\n\n```py\n    def authorize_access_token(self, **kwargs):\n        \"\"\"Fetch access token in one step.\n\n        :return: A token dict.\n        \"\"\"\n        params = request.args.to_dict(flat=True)\n        state = params.get(\"oauth_token\")\n        if not state:\n            raise OAuthError(description='Missing \"oauth_token\" parameter')\n\n        data = self.framework.get_state_data(session, state)\n        if not data:\n            raise OAuthError(description='Missing \"request_token\" in temporary data')\n\n        params[\"request_token\"] = data[\"request_token\"]\n        params.update(kwargs)\n        self.framework.clear_state_data(session, state)\n        token = self.fetch_access_token(**params)\n        self.token = token\n        return token\n```\n\n*authlib/integrations/flask_client/apps.py:57-76*\n\nThis opens up an avenue for Login CSRF in applications that use cache-backed storage. Depending on the dependent application's implementation (e.g., whether it links accounts in the event of a login CSRF), this could lead to account takeover.\n\n## Proof of Concept\n\nConsider a hypothetical application — AwesomeAuthlibApp. Assume that AwesomeAuthlibApp contains internal logic such that, when an already authenticated user performs a `callback` request, the application links the newly provided SSO identity to the existing user account associated with that request.\n\nUnder these conditions, an attacker can achieve account takeover within the application by performing the following actions:\n\n1. The attacker initiates an SSO OAuth flow but halts the process immediately before the callback request is made to AwesomeAuthlibApp.\n2. The attacker then induces a logged-in user (via phishing, a drive-by attack, or similar means) to perform a GET request containing the attacker's state value and authorization code to the AwesomeAuthlibApp callback endpoint. Because Authlib does not verify whether the state token is bound to the session performing the callback, the callback is processed, the authorization code is sent to the provider, and the account linking proceeds.\n\nOnce the GET request is executed, the attacker's SSO account becomes permanently linked to the victim's AwesomeAuthlibApp account.\n\n## Suggested Fix\n\nPer the OAuth RFC [4], the state parameter should be tied to the user's session to prevent exactly such scenarios. One straightforward method of mitigating this issue is to continue storing the state in the session even when caching is enabled.\n\nAn alternative approach would be to hash the session ID (or another per-user secret derived from the session) into the cache key. This ensures the state remains stored in the cache while still being bound to the session of the user that initiated the OAuth flow.\n\n## Resources\n\n- [1] [flask_client/apps.py#L35](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L35)\n- [2] [base_client/framework_integration.py#L33](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/base_client/framework_integration.py#L33)\n- [3] [flask_client/apps.py#L57](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L57)\n- [4] [RFC 6749 §10.12](https://www.rfc-editor.org/rfc/rfc6749#section-10.12)","status":"published","published":"2026-01-08T22:40:56Z","modified":"2026-07-07T17:56:30.89873129Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"PYSEC-2026-1201","title":"Authlib has 1-click Account Takeover vulnerability","description":"# Security Advisory: Cache-Backed State Storage CSRF in Authlib\n\nThe Security Labs team at Snyk has reported a security issue affecting Authlib, identified during a recent research project.\n\nThe Snyk Security Labs team has identified a vulnerability that can result in a one-click account takeover in applications that utilize the Authlib library.\n\n## Description\n\nCache-backed state/request-token storage is not tied to the initiating user session, making CSRF possible for any attacker that possesses a valid state value (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, `FrameworkIntegration.set_state_data` writes the entire state blob under `_state_{app}_{state}`, and `get_state_data` disregards the caller's session entirely. [1][2]\n\n```py\n    def _get_cache_data(self, key):\n        value = self.cache.get(key)\n        if not value:\n            return None\n        try:\n            return json.loads(value)\n        except (TypeError, ValueError):\n            return None\n[snip]\n    def get_state_data(self, session, state):\n        key = f\"_state_{self.name}_{state}\"\n        if self.cache:\n            value = self._get_cache_data(key)\n        else:\n            value = session.get(key)\n        if value:\n            return value.get(\"data\")\n        return None\n```\n\n*authlib/integrations/base_client/framework_integration.py:12-41*\n\nRetrieval in `authorize_access_token` therefore succeeds for whichever browser presents that opaque value, and the token exchange proceeds with the attacker's authorization code. [3]\n\n```py\n    def authorize_access_token(self, **kwargs):\n        \"\"\"Fetch access token in one step.\n\n        :return: A token dict.\n        \"\"\"\n        params = request.args.to_dict(flat=True)\n        state = params.get(\"oauth_token\")\n        if not state:\n            raise OAuthError(description='Missing \"oauth_token\" parameter')\n\n        data = self.framework.get_state_data(session, state)\n        if not data:\n            raise OAuthError(description='Missing \"request_token\" in temporary data')\n\n        params[\"request_token\"] = data[\"request_token\"]\n        params.update(kwargs)\n        self.framework.clear_state_data(session, state)\n        token = self.fetch_access_token(**params)\n        self.token = token\n        return token\n```\n\n*authlib/integrations/flask_client/apps.py:57-76*\n\nThis opens up an avenue for Login CSRF in applications that use cache-backed storage. Depending on the dependent application's implementation (e.g., whether it links accounts in the event of a login CSRF), this could lead to account takeover.\n\n## Proof of Concept\n\nConsider a hypothetical application — AwesomeAuthlibApp. Assume that AwesomeAuthlibApp contains internal logic such that, when an already authenticated user performs a `callback` request, the application links the newly provided SSO identity to the existing user account associated with that request.\n\nUnder these conditions, an attacker can achieve account takeover within the application by performing the following actions:\n\n1. The attacker initiates an SSO OAuth flow but halts the process immediately before the callback request is made to AwesomeAuthlibApp.\n2. The attacker then induces a logged-in user (via phishing, a drive-by attack, or similar means) to perform a GET request containing the attacker's state value and authorization code to the AwesomeAuthlibApp callback endpoint. Because Authlib does not verify whether the state token is bound to the session performing the callback, the callback is processed, the authorization code is sent to the provider, and the account linking proceeds.\n\nOnce the GET request is executed, the attacker's SSO account becomes permanently linked to the victim's AwesomeAuthlibApp account.\n\n## Suggested Fix\n\nPer the OAuth RFC [4], the state parameter should be tied to the user's session to prevent exactly such scenarios. One straightforward method of mitigating this issue is to continue storing the state in the session even when caching is enabled.\n\nAn alternative approach would be to hash the session ID (or another per-user secret derived from the session) into the cache key. This ensures the state remains stored in the cache while still being bound to the session of the user that initiated the OAuth flow.\n\n## Resources\n\n- [1] [flask_client/apps.py#L35](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L35)\n- [2] [base_client/framework_integration.py#L33](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/base_client/framework_integration.py#L33)\n- [3] [flask_client/apps.py#L57](https://github.com/authlib/authlib/blob/260d04edee23d8470057ea659c16fb8a2c7b0dc2/authlib/integrations/flask_client/apps.py#L57)\n- [4] [RFC 6749 §10.12](https://www.rfc-editor.org/rfc/rfc6749#section-10.12)","status":"published","published":"2026-07-07T16:03:17.433137Z","modified":"2026-07-07T17:46:32.335824503Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"UBUNTU-CVE-2025-68158","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.","status":"published","published":"2026-01-08T18:15:00Z","modified":"2026-10-28T20:16:38.081155683Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"openSUSE-SU-2026:10034-1","title":"python311-Authlib-1.6.6-1.1 on GA media","description":"These are all security issues fixed in the python311-Authlib-1.6.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-12T00:00:00Z","modified":"2026-03-23T04:54:21.973664Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20257-1","title":"Security update for python-Authlib","description":"This update for python-Authlib fixes the following issues:\n\nChanges in python-Authlib:\n\n- CVE-2025-68158: Fixed 1-click account takeover in applications that use the Authlib library (bsc#1256414)\n","status":"published","published":"2026-02-19T13:21:50Z","modified":"2026-03-23T04:54:48.653917Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0828-1","title":"Security update for python-Authlib","description":"This update for python-Authlib fixes the following issues:\n\n- CVE-2025-68158: Fixed 1-click account takeover in applications that use the Authlib library (bsc#1256414)\n","status":"published","published":"2026-03-05T15:16:58Z","modified":"2026-03-06T15:30:06.536768Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"USN-8065-1","title":"python-authlib vulnerabilities","description":"Millie Solem discovered that Authlib did not properly restrict algorithm\nselection during JWT verification, allowing HMAC verification with\nasymmetric public keys when no algorithm was specified. A remote attacker\ncould possibly use this issue to bypass signature verification and forge\ntokens, resulting in authentication bypass or privilege escalation.\n(CVE-2024-37568)\n\nMuhammad Noman Ilyas discovered that Authlib did not properly enforce\ncritical header parameter handling during JSON Web Signature verification,\nleading to unknown critical parameters being incorrectly accepted. A remote\nattacker could possibly use this issue to bypass security policies in mixed\ndeployments, resulting in authentication bypass, replay attacks, or\nprivilege escalation. (CVE-2025-59420)\n\nMuhammad Noman Ilyas discovered that Authlib did not properly limit the\nsize of JSON Web Signature or JSON Web Token header and signature segments.\nA remote attacker could possibly use this issue to cause excessive memory\nor processor consumption, leading to a denial of service. (CVE-2025-61920)\n\nMuhammad Noman Ilyas discovered that Authlib performed unbounded\ndecompression when processing certain compressed encrypted tokens. A remote\nattacker could possibly use this issue to send a specially crafted token\nthat can be expanded to a large size during decompression, causing a denial\nof service. (CVE-2025-62706)\n\nIt was discovered that Authlib did not properly bind cached state\ninformation to the initiating user session during OAuth authentication\nflows. A remote attacker could possibly use this issue to perform cross-\nsite request forgery attacks, resulting in unauthorized actions or\nauthentication bypass. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2025-68158)","status":"published","published":"2026-02-25T20:43:00Z","modified":"2026-04-27T18:41:08.675153Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}