Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a remote attacker cause the authorization server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorization request that omits the openid scope. This vulnerability is fixed in 1.6.12 and 1.7.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
OpenHands patched 4 CVEs in one window (CVE-2026-44681, 53571, 48712, 54285). Mem0 fixed CVE-2026-12151 (undici). LiteLLM has client key leak redaction in flight. Unusual concentration - possibly coordinated disclosure or shared dependency. @LiteLLM
Post summary
OpenHands and Mem0 have issued patches for several CVEs with no evidence of active exploitation or provided technical details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | authlib | authlib | - | - | - |
| App | authlib | authlib | 1.7.0 | - | - |