python3-authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers
CVE-2025-68158 is fixed in 3 products on 1 platform, first by python3-authlib 1.3.0-1ubuntu0.1~esm1, released January 8, 2026. It is not reported as exploited. Patch Radar priority: High.
Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that has a valid state (easily obtainable via an attacker-initiated authentication flow). When a cache is supplied to the OAuth client registry, FrameworkIntegration.set_state_data writes the entire state blob under _state_{app}_{state}, and get_state_data ignores the caller’s session altogether. This issue has been patched in version 1.6.6.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python-Authlib · opensuse-leap 15.6 | 1.3.1-150600.3.14.1 | SUSE-SU-2026:0828-1 | Mar 5, 2026 |
| python-Authlib · opensuse-leap 16.0 | 1.5.2-bp160.2.1 | OPENSUSE-SU-2026:20257-1 | Feb 19, 2026 |
| python-Authlib · sles 15.7 | 1.3.1-150600.3.14.1 | SUSE-SU-2026:0828-1 | Mar 5, 2026 |
| python-authlib · Debian 12.15 (bookworm) | 1.2.0-1+deb12u1 | DEBIAN-CVE-2025-68158 | Jan 8, 2026 |
| python-authlib · Debian 13.5 (trixie) | 1.6.0-1+deb13u1 | DEBIAN-CVE-2025-68158 | Jan 8, 2026 |
| python-authlib · Debian 14 | 1.6.6-1 | DEBIAN-CVE-2025-68158 | Jan 8, 2026 |
| python3-authlib · Ubuntu 24.04.5 LTS (noble) | 1.3.0-1ubuntu0.1~esm1 | python3-authlib 1.3.0-1ubuntu0.1~esm1 | Jan 8, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.