CVE-2025-68158 - CVE House
Back to Database
Status published Medium CVE-2025-68158

Authlib: 1-click Account Takeover

Vulnerability Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68158

Credits & Attribution

No credits recorded in the NVD database.

References

More from authlib

View All →
CVE-2025-65015
joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads
Critical 9.2
CVE-2025-62706
Authlib : JWE zip=DEF decompression bomb enables DoS
Medium 6.5
CVE-2025-61920
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
High 7.5
CVE-2025-59420
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
High 7.5

Affected Vendor

Affected Software

authlib
Vulnerable Versions:
>= 1.0.0, < 1.6.6

Timeline

Official Publish: January 8th, 2026
Last Modified: March 30th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-352

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact