PT-2026-23089 · Pypi+1 · Oauthlib+1

Michael-Guignard · Published 2026-03-04 · Updated 2026-05-21 · CVE-2026-28802

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Authlib versions 1.6.5 through 1.6.7

Description Authlib, a Python library for building OAuth and OpenID Connect servers, had a flaw in signature verification. Specifically, tests involving a malicious JWT with 'alg: none' and an empty signature were incorrectly passing verification without any code changes when a failure was expected. This issue was introduced in a commit that altered signature verification logic. Exploitation of this issue could allow attackers to bypass authentication, escalate privileges, gain unauthorized access, or modify application data by submitting forged JWTs. The issue was addressed in version 1.6.7.

Recommendations Authlib versions 1.6.5 through 1.6.7 should be updated to version 1.6.7 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

BDU:2026-04355

CVE-2026-28802

ECHO-579F-8639-173E

GHSA-7WC2-QXGW-G8GG

Affected Products

Oauthlib

Red Os

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28802.json · Exploit
• https://github.com/authlib/authlib/commit/a61c2acb807496e67f32051b5f1b1d5ccf8f0a75 · Patch
• https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg · Vendor Advisory
• https://github.com/authlib/authlib/commit/b87c32ed07b8ae7f805873e1c9cafd1016761df7 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28802 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-28802 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28802 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28802 · Security Note
• https://bdu.fstec.ru/vul/2026-04355 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28802 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-28802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28802 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7wc2-qxgw-g8gg · Vendor Advisory
• https://github.com/authlib/authlib · Note