Vulnerable code sample

import urllib.parse

# In a real application, this would be fetched from a database
# for a given client_id.
REGISTERED_REDIRECT_URIS = [
    'https://my-client-app.com/callback',
    'https://my-client-app.com/oidc/cb'
]

def is_uri_registered(uri, client_id):
    """Simulates checking if a redirect_uri is registered and trusted for a client."""
    # This is a simplified check for demonstration purposes.
    return uri in REGISTERED_REDIRECT_URIS

def create_vulnerable_authorization_response(request_params):
    """
    This function simulates the vulnerable logic within Authlib's OpenID
    grant types before the patch for CVE-2026-44681.

    The vulnerability is an open redirect that occurs when a request
    omits the 'openid' scope.
    """
    scope = request_params.get('scope', '')
    redirect_uri = request_params.get('redirect_uri')
    client_id = request_params.get('client_id')

    if not redirect_uri:
        # In a real scenario, this would return a rendered error page.
        return "Error: redirect_uri is required."

    # =========================================================================
    # VULNERABLE LOGIC BLOCK
    #
    # If the 'openid' scope is NOT present, the code path incorrectly assumes
    # it's a standard OAuth2 request and fails to enforce the strict
    # redirect_uri validation required for OpenID Connect, even in OIDC grants.
    # This allows the unvalidated `redirect_uri` to be used for the redirect.
    # =========================================================================
    if 'openid' not in scope.split():
        print(f"[!] VULNERABLE PATH TRIGGERED: 'openid' scope is missing.")
        print(f"[!] Bypassing redirect_uri validation against registered URIs.")
        # The server would then construct and issue an HTTP 302 Redirect.
        # The 'Location' header would be set to this untrusted URI.
        location = redirect_uri
        print(f"[*] Server would redirect to attacker's URL: {location}")
        return location # This represents the Location header of the 302 redirect.

    # =========================================================================
    # SECURE LOGIC BLOCK (for comparison)
    #
    # If the 'openid' scope IS present, the code correctly performs
    # strict validation of the redirect_uri against the client's registered URIs.
    # =========================================================================
    print(f"[*] Secure Path: 'openid' scope is present.")
    if is_uri_registered(redirect_uri, client_id):
        print(f"[*] Redirect URI '{redirect_uri}' is valid and registered.")
        # A real response would build a proper redirect with params in the fragment.
        location = f"{redirect_uri}#access_token=...&state=..."
        print(f"[*] Server would redirect to: {location}")
        return location
    else:
        print(f"[!] Redirect URI '{redirect_uri}' is NOT registered for this client.")
        return "Error: redirect_uri_mismatch"


if __name__ == '__main__':
    print("--- DEMONSTRATING THE VULNERABILITY (CVE-2026-44681) ---\n")

    # 1. Attacker's crafted request
    # The attacker omits the 'openid' scope and provides a malicious 'redirect_uri'.
    # A user tricked into clicking a link with these parameters would be vulnerable.
    attacker_request_params = {
        'client_id': 'legit-client-123',
        'response_type': 'token',
        'scope': 'profile email',  # 'openid' is deliberately omitted
        'redirect_uri': 'https://evil-attacker.com/collect-token'
    }
    print("--- 1. Simulating Attacker's Request ---")
    result = create_vulnerable_authorization_response(attacker_request_params)
    print(f"--> Result: Open redirect to '{result}'\n")


    # 2. Legitimate user's request (for comparison)
    # A valid request includes the 'openid' scope and a registered redirect_uri.
    legitimate_request_params = {
        'client_id': 'legit-client-123',
        'response_type': 'id_token token',
        'scope': 'openid profile email',  # 'openid' is correctly included
        'redirect_uri': 'https://my-client-app.com/callback'
    }
    print("--- 2. Simulating Legitimate Request ---")
    result = create_vulnerable_authorization_response(legitimate_request_params)
    print(f"--> Result: Secure redirect as expected.\n")