Authlib and Mistune: 16 Vulnerabilities Disclosed in Coordinated Batch
A coordinated disclosure on Oct 22, 2026, revealed 16 vulnerabilities in Python's Authlib and Mistune libraries, impacting authentication and markdown parsing.
Key findings
- 16 vulnerabilities disclosed in Authlib and Mistune on Oct 22, 2026, ranging from Low to High severity.
- Mistune path traversal flaws (CVE-2026-115353, CVE-2026-115355) allow arbitrary file reads.
- Algorithmic complexity vulnerabilities in Mistune (CVE-2026-115352, CVE-2026-115349) can lead to denial of service.
- Authlib issues include improper validation in JWT and OpenID authentication flows (CVE-2026-114620, CVE-2026-114619).
- High-severity flaws affect key management in Authlib (CVE-2026-114616) and file inclusion in Mistune (CVE-2026-115353).
- All vulnerabilities are fixed in Authlib 1.9.0/1.9.1 and Mistune 3.3.0.
On October 22, 2026, a significant batch of 16 vulnerabilities was disclosed across two popular Python libraries: Authlib and Mistune. The vulnerabilities, disclosed within a three-hour window, range in severity from Low to High, with several critical issues impacting both authentication and markdown parsing functionalities. This coordinated disclosure event highlights potential risks for developers relying on these libraries for handling sensitive authentication protocols and rendering user-generated content.
Authlib, a library for building OAuth and OpenID Connect servers, is affected by 7 medium-severity vulnerabilities. These issues primarily stem from improper validation of parameters in authentication requests and token processing. For instance, CVE-2026-114620 involves the improper handling of the request_uri parameter in JWT authentication requests, potentially allowing bypass of security policies. Similarly, CVE-2026-114619 points to a flaw in OpenID Implicit Grant's scope validation, where an ID token could be issued even if not explicitly allowed. CVE-2026-114618 describes a weakness in the JWT Bearer Grant's audience verification, where an attacker could exploit a missing audience check to impersonate a legitimate client. Other Authlib vulnerabilities include issues with nonce validation in ID tokens (CVE-2026-114617), insecure handling of zero-length keys in HMAC signing (CVE-2026-114616), improper parsing of PEM-encoded keys with leading whitespace (CVE-2026-114615), and a bypass of secure transport checks for loopback HTTP exemptions (CVE-2026-114614). All these Authlib vulnerabilities were fixed in version 1.9.0, except for CVE-2026-114616 which was fixed in 1.9.1.
The Mistune markdown parser is affected by 9 vulnerabilities, with a notable concentration of High-severity issues. CVE-2026-115353, a High-severity path traversal vulnerability in the RST include directive, allows attackers to read arbitrary files by supplying relative or absolute paths, potentially embedding sensitive information like credentials. Closely related, CVE-2026-115355 and CVE-2026-115349 also detail path traversal flaws in different directives (Include and general markdown parsing) and algorithmic complexity vulnerabilities leading to denial of service through crafted markdown with unbalanced brackets. CVE-2026-115352 and CVE-2026-115348 highlight algorithmic complexity vulnerabilities in the inline link parser, enabling attackers to exhaust CPU resources with long runs of unmatched '[' characters. CVE-2026-115354, a Medium-severity path traversal, also affects the opt-in Include directive. Additionally, CVE-2026-115351 describes a CSS injection vulnerability via the figwidth option in the figure directive, and CVE-2026-115350, a Medium-severity XSS vulnerability, arises from the Include directive emitting included HTML file content as raw HTML tokens. All Mistune vulnerabilities were addressed in version 3.3.0.
The coordinated disclosure of these vulnerabilities across Authlib and Mistune underscores the importance of regularly updating dependencies, especially those involved in security-critical functions like authentication and content processing. Developers using these libraries should prioritize updating to the patched versions to mitigate the risks associated with parameter validation, key management, path traversal, and denial-of-service attacks. The range of issues, from subtle authentication bypasses to resource exhaustion, indicates a need for thorough security reviews of applications relying on these components.
Key findings from this disclosure include:
- Multiple path traversal and denial-of-service vulnerabilities in Mistune, with several rated High severity.
- Authlib vulnerabilities primarily related to improper validation in OAuth and OpenID Connect flows.
- A critical flaw in Mistune's RST include directive allowing arbitrary file reads.
- Algorithmic complexity issues in Mistune's link parsing leading to potential CPU exhaustion.
- Authlib's RFC 9101 JWTAuthenticationRequest and OpenIDImplicitGrant were found to have validation flaws.
- All disclosed vulnerabilities in both libraries have been patched in their respective latest versions.