CVE-2026-28802 — Improper Verification of Cryptographic Signature in Authlib

CWE-347 — Improper Verification of Cryptographic Signature8 documents7 sources
Severity
7.7HIGHNVD
EPSS
0.0%
top 90.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
AuthlibDebian Python-authlib
Timeline
PublishedMar 6
Latest updateApr 15

Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages4 packages

▶debiandebian/python-authlib< python-authlib 1.6.7-1 (forky)
▶NVDauthlib/authlib1.6.5 — 1.6.7
▶PyPIauthlib/authlib1.6.5 — 1.6.7
▶CVEListV5authlib/authlib>= 1.6.5, < 1.6.7

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
VulDB
Authlib up to 1.6.6 JWT signature verification (GHSA-7wc2-qxgw-g8gg / Nessus ID 301403)↗2026-04-15
▶
OSV
CVE-2026-28802: Authlib is a Python library which builds OAuth and OpenID Connect servers↗2026-03-06
▶
OSV
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification↗2026-03-04
▶
GHSA
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification↗2026-03-04
▶

📋Vendor Advisories

2
Red Hat
authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access↗2026-03-06
▶
Debian
CVE-2026-28802: python-authlib - Authlib is a Python library which builds OAuth and OpenID Connect servers. From ...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-28802 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶