Authlib, a Python library that implements OAuth and OpenID Connect servers, contained a flaw in its OAuth 2.0 authorization endpoint that allowed an attacker to trigger an unauthenticated open redirect when using an unsupported response_type. The vulnerability permits elevating a 302 Location response to an arbitrary attacker‑controlled URL without a valid client registration, user authentication, or prior state. The misuse of redirect_uri before client lookup and validation can be exploited to phishing or drive‑by‑download attacks, compromising user trust and potentially revealing credentials. The weakness is identified as CWE‑601 open redirect.

The affected parties are developers and organizations using Authlib versions prior to 1.6.10 and 1.7.1. Accepted versions are 1.6.x before 1.6.10 and 1.7.x before 1.7.1. The product that is impacted is the Authlib library itself used to build OAuth 2.0 and OpenID Connect servers.

The CVSS score of 5.4 points to moderate risk, and the vulnerability is not listed in the CISA KEV catalog. With no EPSS data available, the exploitation probability remains uncertain, but the flaw is trivially exploitable: a single unauthenticated HTTP request to the authorization endpoint is sufficient to obtain a 302 redirect to a malicious site. Attackers can execute phishing campaigns or redirect users to malicious services without needing any pre‑existing client configuration. The lack of authentication or client validation before redirect handling amplifies the potential impact.