Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Authlib (#Python), CSRF (Cache-Backed OAuth State), #CVE-2025-68158 (Medium) https://dailycve.com/authlib-python-csrf-cache-backed-oauth-state-cve-2025-68158-medium/
Post summary
The post announces the medium‑severity CSRF vulnerability CVE‑2025‑68158 in Authlib for Python, providing basic technical details and a link to a disclosure article.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | authlib | authlib | - | - | - |