CVE-2025-68158: CSRF in Authlib Cache-Backed State Storage

The core of this vulnerability lies in Authlib's cache-backed state/request-token storage. Critically, this storage isn't bound to the user's session. An attacker can exploit this by initiating an authentication flow, obtaining a valid state value, and then crafting a malicious request that leverages this state to impersonate the user. Successful exploitation results in an account takeover, granting the attacker full control over the affected user's account. This is particularly concerning for applications relying on Authlib for authentication, as it bypasses typical CSRF protections. The ease of exploitation – a 'one-click' takeover – significantly elevates the risk.

1. Reserved2025-12-15
2. Published2026-01-08
3. Modified2026-03-30
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-68158 is to upgrade to Authlib version 1.6.6 or later, which addresses the flawed state storage mechanism. If upgrading immediately is not feasible, consider implementing stricter CSRF protection measures at the application level. This could involve implementing double-submit cookies or other robust CSRF defenses. Additionally, carefully review and validate all authentication flows to ensure the state value is properly tied to the user's session. Monitor application logs for unusual authentication activity and investigate any suspicious requests involving state values.