An advisory from the Authlib project (GHSA-c73q-w75p-j82v, CVE-2026-116672, CVSS 3.1 8.8, Authlib 0.15 to 1.9.0) covers its RFC 7592 ClientConfigurationEndpoint.

• Bug: the endpoint calls authenticate_token, authenticate_client and check_permission, which developers must implement. The shipped docstring examples look the target client up from the request's client_id and check only client.editable, so nothing verifies that the presented registration_access_token was issued to that client.
• Exploit path: where RFC 7591 registration is open (common), an attacker registers a throwaway client, takes its token, and sends GET/PUT/DELETE /register/<victim_client_id>. A PUT can repoint the victim's redirect_uris to intercept authorization codes or tokens for that client's users.
• Fix: Authlib 1.9.1 (released Oct 14) makes the endpoint reject a registration access token issued to another client, and the docs now read client_id from the URL instead of the body.

What to do: upgrade to 1.9.1 and review your own authenticate_client/check_permission implementations: confirm that request.credential (the token) maps to the client being accessed. Audit recent client registration updates for changed redirect_uris. MCP authorization servers that enable dynamic client registration should treat this as in scope.