Authlib exposed an unauthenticated open redirect in its OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoints prior to versions 1.6.12 and 1.7.1. Attackers can craft a request that omits the openid scope to cause the authorization server to issue an HTTP 302 redirect to an arbitrary, attacker-chosen URL. The vulnerability enables phishing or credential-stealing attacks by misleading users into believing they are interacting with the legitimate authorization server. The weakness is represented by CWE-601 (Open Redirect) and CWE-863 (Missing authorization scope).

The issue affects the Authlib library for Python. Versions earlier than 1.6.12 and 1.7.1 are vulnerable; any deployment that implements Open ID Connect implicit or hybrid flows using those versions is at risk.

The CVSS score is 6.1, indicating moderate severity. No EPSS data is available, and it is not listed in the CISA KEV catalog. The attack vector is remote; a client‑side actor can trigger the redirect by sending an unauthenticated authorization request to the impacted server. Successful exploitation requires the attacker to target a legitimate instance of Authlib that exposes its OIDC endpoints.