Authlib’s is_secure_transport() function incorrectly treats URLs whose userinfo starts with a loopback host as safe, so an attacker can supply a URL such as http://loopback@evil.com that will be accepted as secure even though the request goes to a non‑loopback external host. The flaw permits cleartext HTTP URLs to be invoked for OIDC RP‑Initiated Logout registration, authorization‑server metadata validation, or similar flows, but it does not allow forging tokens or authenticating users. The result is a transport security bypass that could expose sensitive data or redirect clients to malicious sites without TLS protection.

Python developers who are using Authlib versions 0.13 through 1.7.x are vulnerable because those releases rely on a textual prefix comparison in is_secure_transport(). The fix was introduced in Authlib 1.8.0, which replaces the insecure logic with a proper host comparison. Versions earlier than 0.13 have not been documented as affected where the behavior may differ, so the scope is limited to 0.13‑1.7.x.

The CVSS score of 2.6 indicates a low overall severity, and no EPSS rating is available while the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by supplying a malicious URL containing a loopback‑host prefix in its userinfo component to any OIDC RP‑Initiated Logout registration or authorization‑server metadata validation endpoint that uses Authlib’s transport‑security check. The attack does not provide code execution or direct credential theft, but it can result in cleartext transmission of data or redirecting users to non‑TLS sites, thereby compromising confidentiality.