PT-2026-25780 · Pypi+1 · Oauthlib+1

Jaynornj + 1 · Published 2026-01-01 · Updated 2026-05-21 · CVE-2026-28490

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.9

Description Authlib, a Python library for building OAuth and OpenID Connect servers, contains a cryptographic padding oracle vulnerability in the implementation of the JSON Web Encryption (JWE) RSA1 5 key management algorithm. The library registers RSA1 5 in its default algorithm registry without requiring explicit opt-in and disables the constant-time Bleichenbacher mitigation implemented by the underlying cryptography library. This allows an attacker to exploit a weakness in the padding process to potentially decrypt encrypted keys. The vulnerability arises because Authlib raises a specific exception ('ValueError: Invalid "cek" length') when the padding is invalid, creating a distinguishable path from a valid padding scenario. This exception oracle, combined with the default configurations of common Python web frameworks (Flask, Django, and FastAPI), enables exploitation without additional server misconfiguration. The issue is present in versions prior to 1.6.9.

Recommendations Update Authlib to version 1.6.9 or later.

Exploit

Fix

Side Channel Attack

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-203

CWE-327

Related Identifiers

BDU:2026-07263

CVE-2026-28490

ECHO-C9A3-95EC-F0D8

GHSA-7432-952R-CW78

OPENSUSE-SU-2026:20392-1

SUSE-SU-2026:0975-1

Affected Products

Oauthlib

Red Os

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28490.json · Exploit
• https://github.com/authlib/authlib/security/advisories/GHSA-7432-952r-cw78 · Vendor Advisory
• https://github.com/authlib/authlib/commit/48b345f29f6c459f11c6a40162b6c0b742ef2e22 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28490 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20392-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7432-952r-cw78 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-28490 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28490 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-28490 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28490 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28490 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07263 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0975-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28490 · Vendor Advisory