---
id: CVE-2026-114614
title: >-
  authlib: Authlib: Transport security bypass via improper URL validation
  (CVE-2026-114614)
summary: >-
  A flaw was found in Authlib. The library's transport security verification
  improperly validates web addresses by using prefix matching to exempt local
  loopback addresses from encryption requirements. A remote attacker can exploit
  this issu…
severity: low
cvss: 2.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-319
  - CWE-601
  - CWE-693
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2
affected:
  - exploit_intelligence
  - lightspeed_core
  - migration_toolkit_for_applications 8
  - openshift_lightspeed
  - ansible_automation_platform 2
  - enterprise_linux_command_line_assistant
  - openshift_virtualization 4
  - quay 3
  - satellite 6
published: '2026-10-22'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T00:38:47+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114614.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114614.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114614'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2559389'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-114614'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114614'
  - url: >-
      https://github.com/authlib/authlib/commit/95ad1f90acf0c7b9cf2a8f25e6eb3f1135b8dc70
  - url: 'https://github.com/authlib/authlib/releases/tag/v1.8.0'
  - url: 'https://github.com/authlib/authlib/security/advisories/GHSA-jj7h-c3hg-m23x'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-22T22:00:50.435Z'
---

## Overview

A flaw was found in Authlib. The library's transport security verification improperly validates web addresses by using prefix matching to exempt local loopback addresses from encryption requirements. A remote attacker can exploit this issue by supplying a crafted URL containing local host information in the user credentials field to bypass Transport Layer Security (TLS) enforcement. This flaw can lead to the acceptance of unencrypted connections or redirection to external cleartext servers, potentially exposing sensitive information in transit.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Exploit Intelligence, Lightspeed Core, Migration Toolkit for Applications 8, OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux command line assistant, … · no fix planned: Exploit Intelligence, Red Hat Quay 3, Lightspeed Core, Migration Toolkit for Applications 8, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114614.json)

**authlib: Authlib: Transport security bypass via improper URL validation** — rated Low by Red Hat. Released 2026-10-22, updated 2026-10-23.

Affected:

- Exploit Intelligence
- Lightspeed Core
- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux command line assistant
- Red Hat OpenShift Virtualization 4
- Red Hat Quay 3
- Red Hat Satellite 6

No fix planned:

- Exploit Intelligence
- Red Hat Quay 3
- Lightspeed Core
- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux command line assistant
- Red Hat OpenShift Virtualization 4
- Red Hat Satellite 6

## Remediation

Out of support scope