CVE-2026-104056

Summary

The flaw allows a poisoned discovery response to replace all endpoint values with attacker-controlled values, bypassing security measures and potentially leading to unauthorized access or manipulation of the application.

Exploitability

Exploitation is relatively straightforward as it requires control over the discovery response, which may be feasible in environments with misconfigured or unsecured metadata URLs.

Blast radius

If exploited, the vulnerability could have a wide impact, potentially allowing attackers to control critical endpoints and compromise the entire application.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Authlib version 1.7.3 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.