Authlib hat eine 1-Klick-Kontoübernahme-Vulnerabilität

The core of this vulnerability lies in Authlib's cache-backed state/request-token storage. Critically, this storage isn't bound to the user's session. An attacker can exploit this by initiating an authentication flow, obtaining a valid state value, and then crafting a malicious request that leverages this state to impersonate the user. Successful exploitation results in an account takeover, granting the attacker full control over the affected user's account. This is particularly concerning for applications relying on Authlib for authentication, as it bypasses typical CSRF protections. The ease of exploitation – a 'one-click' takeover – significantly elevates the risk.

Applications utilizing Authlib for OAuth 2.0 or OpenID Connect authentication, particularly those relying solely on Authlib's built-in state management without additional CSRF protections, are at significant risk. This includes web applications, APIs, and microservices that integrate with Authlib for authentication purposes.

• python / server:

import hashlib

def check_authlib_version():
    import authlib
    version = authlib.__version__
    if version <= '1.6.5':
        print(f"Authlib version {version} is vulnerable to CVE-2025-68158. Upgrade to 1.6.6 or later.")
    else:
        print(f"Authlib version {version} is not vulnerable.")

check_authlib_version()

• generic web: Use a web proxy or browser extension to inspect network traffic during authentication flows. Look for requests containing state parameters that are not properly validated or tied to the user's session.

1. 2026-01-08Disclosure

   disclosure

1. Reserviert2025-12-15
2. Veröffentlicht2026-01-08
3. Geändert2026-03-30
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-68158 is to upgrade to Authlib version 1.6.6 or later, which addresses the flawed state storage mechanism. If upgrading immediately is not feasible, consider implementing stricter CSRF protection measures at the application level. This could involve implementing double-submit cookies or other robust CSRF defenses. Additionally, carefully review and validate all authentication flows to ensure the state value is properly tied to the user's session. Monitor application logs for unusual authentication activity and investigate any suspicious requests involving state values.