Package vulnerability, severity high

Authlib RFC 7592 examples omit registration-access-token client binding

Published October 30, 2026, updated October 31, 2026

Authlib RFC 7592 examples omit registration-access-token client binding. Source: GHSA-c73q-w75p-j82v (CVE-2026-116672).

What's affected

• authlib (pypi)>=0.15 <1.9.1

What to do

1. Upgrade authlib to 1.9.1 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-c73q-w75p-j82v

References

• https://osv.dev/vulnerability/GHSA-c73q-w75p-j82v
• https://github.com/authlib/authlib/security/advisories/GHSA-c73q-w75p-j82v
• https://nvd.nist.gov/vuln/detail/CVE-2026-116672
• https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff
• https://github.com/authlib/authlib
• https://github.com/authlib/authlib/releases/tag/v1.9.1

Notice ghsa-c73q-w75p-j82v, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.