Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:0828-1

Опубликовано: 05 мар. 2026
Источник: suse-cvrf

Описание

Security update for python-Authlib

This update for python-Authlib fixes the following issues:

  • CVE-2025-68158: Fixed 1-click account takeover in applications that use the Authlib library (bsc#1256414)

Список пакетов

SUSE Linux Enterprise Module for Python 3 15 SP7
python311-Authlib-1.3.1-150600.3.14.1
openSUSE Leap 15.6
python311-Authlib-1.3.1-150600.3.14.1

Ссылки

Описание

Authlib is a Python library which builds OAuth and OpenID Connect servers. In version 1.6.5 and prior, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller's session altogether. This issue has been patched in version 1.6.6.

Затронутые продукты
SUSE Linux Enterprise Module for Python 3 15 SP7:python311-Authlib-1.3.1-150600.3.14.1
openSUSE Leap 15.6:python311-Authlib-1.3.1-150600.3.14.1
Ссылки