Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.

INFO

Published Date :

2026-03-06T06:44:26.402Z

Last Modified :

2026-03-06T16:05:35.082Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-28802 vulnerability.

Vendors Products
Authlib
  • Authlib
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-28802.

URL Resource
https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75 cve-icon cve-icon cve-icon
https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7 cve-icon cve-icon cve-icon
https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-28802 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-28802 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact