Authlib EUVD-2026-108513

Exploitation requires a deployment that relies on is_secure_transport() to reject cleartext non-loopback URLs supplied by an external party, on Authlib versions >=0.13 and <=1.7.2. The primary realistic path is an OpenID Provider with OIDC dynamic client registration AND RP-Initiated Logout enabled, where a public client (token_endpoint_auth_method 'none') registers a post_logout_redirect_uris entry of the form http://localhost:80@attacker.example/cb (also http://localhost:@attacker.example/, http://127.0.0.1:...@attacker.example/, http://[::1]:...@attacker.example/). A secondary path is a relying party calling AuthorizationServerMetadata.validate() on a discovery document the attacker can influence. Limiting factors: the dynamic-registration/RP-logout features are not enabled by default and must be configured; the end-user must actually initiate the logout flow (UI:R) for the redirect to fire; the flaw does not bypass OAuth redirect-URI exact matching and yields no token forgery or authentication bypass. The AUTHLIB_INSECURE_TRANSPORT env var is unrelated to the bypass.

This is a genuinely low-priority issue and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N, base 2.6) and the vuln.today 'monitor' decision label both point to minor severity, matching the vendor's own framing of a defense-in-depth / spec-conformance failure. The attack is network-reachable but gated by high complexity (crafted userinfo URL plus a non-default provider configuration), low privileges, and required user interaction (the victim must initiate logout). Impact is limited to confidentiality (C:L - the OAuth 'state' value sent over cleartext) with no integrity or availability effect; the advisory explicitly states it does NOT bypass redirect-URI exact matching and does NOT forge tokens or authenticate users. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active exploitation; this is 'no public exploit identified' in the KEV sense, though a detailed proof-of-concept is published in the GHSA advisory. Net: a real, confirmed bug worth patching on a normal maintenance cadence, not an emergency.

An OpenID Provider built on Authlib that enables OIDC dynamic client registration and RP-Initiated Logout lets a public client register a post_logout_redirect_uris value of http://localhost:80@attacker.example/cb; is_secure_transport() accepts it because the 'http://localhost:' prefix matches the userinfo component rather than the real host (evil/attacker.example), so when a victim later logs out the provider 302-redirects their browser to the attacker's cleartext endpoint carrying the state parameter. A working proof-of-concept is published in the GHSA advisory. The network vector with AC:H and UI:R means exploitation depends on the non-default config and on the user initiating logout.