CVE-2026-41425: 
Python vulnerability analysis and mitigation

CVE-2026-41425 is a Cross-Site Request Forgery (CSRF) vulnerability in Authlib, a Python library for building OAuth and OpenID Connect servers. The flaw exists in the authlib.integrations.starlette_client.OAuth integration (and potentially other integrations) when the cache parameter is used to store OAuth authentication state. All versions of Authlib prior to 1.6.11 are affected. It was published on April 24, 2026, and carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory).

The root cause is classified as CWE-352 (Cross-Site Request Forgery). When Authlib's Starlette OAuth client uses the cache parameter to store OAuth state, it lacks the session-binding mechanism that SessionMiddleware provides in the non-cache path. Specifically, the state parameter is taken from the callback URL and fetched from the cache without verifying that the same client that initiated the auth flow is the one completing it — a requirement documented in RFC 6749 Section 10.12. This allows an attacker to initiate an OAuth flow, capture the redirect URL, and trick a victim into completing the authorization, effectively binding the attacker's account or credentials to the victim's session. The advisory notes that other integrations beyond Starlette share the same issue (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to manipulate the OAuth authentication flow, potentially tying an attacker-controlled account to a victim's identity or session. This results in low confidentiality and integrity impacts — an attacker could gain unauthorized access to resources the victim is authorized to use, or inject attacker-controlled OAuth credentials into the victim's session. Availability is not impacted. All users relying on the cache-based state storage for OAuth flows are affected (GitHub Advisory).

A proof-of-concept exploit sequence is publicly documented in the GitHub Security Advisory, describing how an attacker initiates the OAuth flow, captures the redirect URL, and sends it to a victim to complete authorization. There is no evidence of active in-the-wild exploitation at this time, and no attribution to specific threat actors has been reported. The EPSS score is approximately 0.014% (0.000140), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Setup: Identify a target application using Authlib's Starlette (or other affected) OAuth integration with the cache parameter enabled for state storage.
2. Initiate OAuth flow: As the attacker, begin the OAuth authorization flow on the target application to generate a valid state parameter and obtain the redirect/callback URL.
3. Capture redirect URL: Stop before following the callback URL, capturing the full redirect URL containing the state and code parameters.
4. Deliver to victim: Send the captured redirect URL to the victim (e.g., via phishing, malicious link, or social engineering).
5. Victim completes authorization: The victim clicks the link and their browser completes the OAuth callback, which the server processes without verifying that the same client initiated the flow — binding the attacker's OAuth state to the victim's session.
6. Account linkage: The attacker's account or credentials become associated with the victim's session, potentially granting the attacker access to the victim's resources (GitHub Advisory).

• Logs: OAuth callback requests where the state parameter originates from a different IP address or user agent than the one that initiated the authorization flow.
• Logs: Multiple OAuth callback completions for the same state value from different clients or sessions.
• Application Behavior: Unexpected account linkages or OAuth token associations where a user's session is tied to an unfamiliar third-party account.
• Network: Unusual referrer headers or missing referrer on OAuth callback endpoint requests, which may indicate the callback URL was delivered out-of-band rather than via normal browser redirect.

Upgrade Authlib to version 1.6.11 or later, which introduces CSRF protection for the cache-based OAuth state feature. As a workaround prior to patching, avoid using the cache parameter in OAuth integrations and rely on SessionMiddleware instead, which ties the auth state to the session and prevents CSRF attacks. Additionally, consider implementing SameSite cookie attributes and validating the state parameter integrity during OAuth callbacks as defense-in-depth measures (GitHub Advisory).

The vulnerability was reported by security researcher JohnnyDeuss and published by maintainer azmeuk via GitHub's security advisory process on April 16, 2026. No significant broader media coverage or notable public social media discussion has been identified beyond the advisory itself.