Authlib, a Python library for OAuth and OpenID Connect servers, had a flaw in the cache feature of its Starlette client integration where no CSRF protection was in place. Because of this, malicious actors could trick users into sending requests that the application would process as if they were legitimate. The vulnerability is categorized as CWE‑352 (Cross‑Site Request Forgery) and CWE‑807 (Protection Mechanism Failure).

The flaw applies to any deployment of Authlib prior to version 1.6.11 that uses the authlib.integrations.starlette_client.OAuth module. Any Python application incorporating Authlib for OAuth authentication and enabling the cache functionality is potentially affected.

The flaw combines a protection mechanism failure (CWE‑807) and a missing CSRF guard (CWE‑352). The CVSS score of 5.4 indicates a medium severity rating. The EPSS score of less than 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to target a user who has already authenticated with the application and use the cache function to form a forged request. The attack vector is likely browser‑based and requires the victim to interact with the attacker’s web content, which reduces but does not eliminate exploitability.