Authlib below 1.9.0 has SSRF in RFC 9101 JAR implementation

Authlib versions prior to 1.9.0 contain an SSRF vulnerability (CVE-2026-114620, CVSS 5.4) in its RFC 9101 JWT-Secured Authorization Request implementation. JWTAuthenticationRequest passes an unauthenticated request_uri to get_request_object() without destination validation, enabling blind internal network scanning when the hook performs unrestricted HTTP fetches. The flaw is fixed in 1.9.0.

• CVE-2026-114620: SSRF in Authlib, CVSS 5.4, published October 27, 2026
• Authlib versions below 1.9.0 are affected; fixed in 1.9.0
• Exploitation needs a valid client_id and an unsafe get_request_object() implementation
• Impact is blind scanning of internal ports and services via error responses