PT-2026-23089 · Pypi+1 · Oauthlib+1

Michael-Guignard · Publicado 2026-03-04 · Atualizado 2026-06-08 · CVE-2026-28802

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Authlib versions 1.6.5 through 1.6.7

Description Authlib, a Python library for building OAuth and OpenID Connect servers, had a flaw in signature verification. Specifically, tests involving a malicious JWT with 'alg: none' and an empty signature were incorrectly passing verification without any code changes when a failure was expected. This issue was introduced in a commit that altered signature verification logic. Exploitation of this issue could allow attackers to bypass authentication, escalate privileges, gain unauthorized access, or modify application data by submitting forged JWTs. The issue was addressed in version 1.6.7.

Recommendations Authlib versions 1.6.5 through 1.6.7 should be updated to version 1.6.7 or later.

Exploit

Correção

DoS

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

BDU:2026-04355

CVE-2026-28802

ECHO-579F-8639-173E

GHSA-7WC2-QXGW-G8GG

Produtos afetados

Oauthlib

Red Os

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28802.json · Exploit
• https://github.com/authlib/authlib · Nota
• https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7 · Correção
• https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75 · Correção
• https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2029927656054005986 · Publicação no Twitter
• https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-28802 · Nota
• https://bdu.fstec.ru/vul/2026-04355 · Nota de Segurança
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-28802 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2031128068610572407 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-28802 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-python-authlib-cve-2026-28802-8.0 · Nota
• https://t.me/CVEtracker/46569 · Publicação no Telegram
• https://t.me/cveNotify/154472 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-28802 · Aviso do Fabricante