PT-2026-25790 · Oauthlib+1 · Oauthlib+1

Jaynornj + 1 · Published 2026-01-01 · Updated 2026-05-21 · CVE-2026-28498

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Authlib and Affected Versions Authlib versions prior to 1.6.9

Description Authlib, a Python library for building OAuth and OpenID Connect servers, contains a flaw in its OpenID Connect (OIDC) ID Token validation logic. The internal hash verification function ( verify hash) exhibits a fail-open behavior when it encounters an unsupported or unknown cryptographic algorithm. This allows an attacker to bypass integrity protections by supplying a forged ID Token with an unrecognized algorithm parameter. The library silently returns a successful validation result, violating cryptographic principles and OIDC specifications. This issue can lead to Token Substitution Attacks, potentially allowing attackers to use malicious Access Tokens or Authorization Codes. The vulnerability resides in the verify hash function within authlib/oidc/core/claims.py. The function create half hash returns None for unknown algorithms, and verify hash incorrectly interprets this as a successful verification.

Recommendations Update to Authlib version 1.6.9 or later to resolve this issue.

Exploit

Fix

Weakness Enumeration

CWE-354

CWE-573

Related Identifiers

BDU:2026-04354

CVE-2026-28498

ECHO-435F-9EB9-99CB

GHSA-M344-F55W-2M6J

OPENSUSE-SU-2026:20392-1

SUSE-SU-2026:0975-1

Affected Products

Oauthlib

Red Os

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28498.json · Exploit
• https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j · Vendor Advisory
• https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b · Patch
• https://safe-surf.ru/specialists/bulletins-nkcki/730391 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-28498 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-28498 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-28498 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m344-f55w-2m6j · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20392-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0975-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04354 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-28498 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-28498 · Security Note
• https://ubuntu.com/security/CVE-2026-28498 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-28498 · Vendor Advisory