Authlib is a Python library that implements OAuth and OpenID Connect. A flaw in the OpenIDMixin.parse_id_token() method allowed a token to disable its own nonce validation by setting the "nonce_supported" claim to false. When a library instance reads this claim from an incoming token, it clears the expected nonce, effectively severing the link between the token and the original session. An attacker who captures or forges a validly signed token containing this claim can replay the token within an attacker‑controlled session, gaining access without proper nonce checks. The token must still pass signature, issuer, and audience validation, so the attacker must obtain a legitimately signed token from the provider.

Any application that uses Authlib’s OpenIDMixin prior to version 1.9.0 and relies on the implicit or hybrid grant flows is impacted. This includes the sync_openid.py and async_openid.py integration modules. Applications that employ the pure authorization code flow are not affected, as the nonce is handled differently there.

The CVSS score of 4.2 indicates a moderate risk level. Because the vulnerability requires a valid token and operates only in implicit or hybrid flows, the exploitation surface is limited, and no EPSS data is available and the issue is not listed in CISA’s KEV catalog. Attacks would involve capturing a token with "nonce_supported": false or forging such a token, then replaying it into a session controlled by the attacker. The overall likelihood of widespread exploitation remains low, but the impact can include unauthorized session access for those using the vulnerable flows.