Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
authlib authlib
>= 1.6.5, < 1.6.7affected
References
- https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg ↗
- https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75 ↗
- https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7 ↗
- https://access.redhat.com/security/cve/CVE-2026-28802 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2445120 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28802.json ↗
- https://access.redhat.com/errata/RHSA-2026:6309 ↗
- https://access.redhat.com/errata/RHSA-2026:5665 ↗
- https://access.redhat.com/errata/RHSA-2026:4942 ↗
- https://access.redhat.com/errata/RHSA-2026:6568 ↗
- https://access.redhat.com/errata/RHSA-2026:19375 ↗
- https://access.redhat.com/errata/RHSA-2026:5168 ↗