Critical severity · published Mar 6, 2026
CVE-2026-28802
Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
authlib · authlib
>= 1.6.5, < 1.6.7 · source: vendor, NVD
RH
Red Hat Ansible Automation Platform 2.6 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.10 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.12 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.15 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.16 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Quay 3.9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Satellite 6 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28802
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28802
Patch
https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75
Patch
https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7
Exploit
https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:19375
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:4942
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:5168
More from authlib
9.8
CVE-2026-104056
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding
9.8
CVE-2026-96760
Authlib library contains a signature‑verification bypass vulnerability
9.1
CVE-2026-27962
Authlib JWS JWK Header Injection: Signature Verification Bypass
8.8
CVE-2026-116672
Authlib RFC 7592 examples omit registration-access-token client binding
8.8
CVE-2025-68158
Authlib: 1-click Account Takeover