Authlib
CVE-2026-28802
HIGH
GHSA-7wc2-qxgw-g8gg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify service using Authlib JWT verification
-
DeliveryCraft JWT with alg:none and empty signature
-
ExploitSubmit forged token to endpoint
-
ExecutionVerification incorrectly passes
-
ImpactImpersonate arbitrary identity or escalate privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | The target application must use Authlib version 1.6.5 or 1.6.6 to verify inbound JWS/JWTs as a trust boundary, and must invoke the verification in a way that relies on Authlib to reject invalid-algorithm tokens (rather than enforcing its own algorithm allowlist). The specific trigger is a JWT with header 'alg: none' and an empty signature, which the flawed verification accepts. Limiting factors: exploitation only matters where the JWT signature check is actually the security control (e.g., access tokens, ID tokens, or session assertions validated server-side); applications that independently pin an allowed algorithm set, or that are outside the 1.6.5-1.6.6 range, are not exploitable. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any party able to submit a token to the verification endpoint can attempt it. |
| Impact | Signals are somewhat split. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high integrity impact (VC:N/VI:H/VA:N) - meaning no confidentiality or availability loss but full integrity/authentication compromise, scored 7.7 (High). Against that, EPSS is very low at 0.02% (6th percentile) and the CVE is absent from CISA KEV, indicating no observed mass exploitation. Public exploit/PoC code exists (the advisory's regression test demonstrates the bypass), so the technical barrier is trivial once a target uses an affected version in a verification-dependent flow. The realistic priority is high for any service that uses Authlib to validate inbound JWTs as a trust boundary (it is a direct auth bypass), but the low EPSS reflects that exploitation depends on a victim deploying a narrow vulnerable version range (1.6.5-1.6.6) rather than a widespread internet-facing weakness. Note: the CVSS 4.0 vector marks integrity-only impact; confidentiality and availability are rated N, so this is specifically an identity/forgery risk, not data theft or DoS per the scoring. |
| Exploit ScenarioDerived | An attacker targeting a service that uses Authlib 1.6.5/1.6.6 to validate incoming JWTs crafts a token with the header 'alg: none', sets arbitrary claims (e.g., an admin subject or elevated scopes), and sends it with an empty signature. Because verification incorrectly passes, the service trusts the forged identity and grants unauthorized access. PoC demonstrating the bypass is public in the security advisory, and the CVSS AC:L/PR:N profile means no special privileges or complex steps are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jun 30, 2026
Authentication bypass in Authlib (Python OAuth/OpenID Connect library) versions 1.6.5 through 1.6.6 allows remote attackers to forge JWTs by supplying a token with 'alg: none' and an empty signature, which the library accepts as valid during signature verification. Because the integrity check is silently bypassed, an attacker can craft tokens with arbitrary claims and impersonate any identity. Publicly available exploit code exists (regression-test based, via the GitHub Security Advisory), but EPSS is only 0.02% (6th percentile) and the issue is not in CISA KEV - no public exploit identified as actively used at time of analysis.
Earlier versions of this analysis (4)
JWT signature forgery in the Authlib Python library (versions 1.6.5 and 1.6.6) lets remote attackers bypass signature verification by submitting a token with the 'alg: none' header and an empty signature, which is silently accepted as valid. Any service relying on Authlib to validate JWTs - OAuth/OpenID Connect resource servers, API gateways, session validators - can be tricked into trusting attacker-forged claims such as elevated roles or arbitrary user identities. Publicly available exploit code exists (a working PoC is in the GHSA advisory); EPSS is very low (0.02%) and the issue is not on CISA KEV, so no active exploitation is confirmed.
Signature-verification bypass in the Authlib Python library (versions 1.6.5 and 1.6.6) allows remote attackers to forge JWTs using the 'alg: none' header with an empty signature and have them accepted as valid, enabling authentication bypass and identity/claims spoofing. A regression introduced in commit a61c2acb caused 'none'-algorithm tokens to silently pass verification even when the application expected rejection. Publicly available exploit code exists (GitHub Security Advisory GHSA-7wc2-qxgw-g8gg), though EPSS scores it at just 0.02% and it is not listed in CISA KEV.
Signature verification bypass in Authlib (Python OAuth/OpenID Connect library) versions 1.6.5 up to but not including 1.6.7 allows attackers to submit a forged JWT using 'alg: none' with an empty signature and have it accepted as valid. Because the token passes verification where it should be rejected, an attacker can forge or tamper with token claims to impersonate users or escalate privileges against servers built on the library. Publicly available exploit code exists (GHSA-7wc2-qxgw-g8gg), though the EPSS exploitation probability is negligible at 0.02% and it is not listed in CISA KEV.
JWT bypass in Authlib Python library.
RemediationAI
Vendor-released patch: upgrade Authlib to version 1.6.7, which fixes the verification logic (commits a61c2acb807496e67f32051b5f1b1d5ccf8f0a75 and b87c32ed07b8ae7f805873e1c9cafd1016761df7). Red Hat users should apply the relevant errata for their product (e.g., RHSA-2026:6309, RHSA-2026:5665, RHSA-2026:4942 and others) via https://access.redhat.com/security/cve/CVE-2026-28802. If immediate upgrade is not possible, the most effective compensating control is to enforce an explicit algorithm allowlist in your JWT/JWS verification configuration so that 'none' is never accepted - for example, require RS256/ES256/HS256 and reject any token whose alg is 'none' or whose signature is empty; the trade-off is minimal but you must ensure every verification call site passes the allowlist, since a missed call site reopens the gap. Reference advisory: https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Authlib is a widely-used Python library for building OAuth 2.0 and OpenID Connect authorization and resource servers, where JSON Web Tokens (JWT/JWS) are the core credential format. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the JWS verification path failed to reject the 'none' algorithm with an empty signature, so a token that should fail validation instead passed. The 'alg:none' attack is a classic JWT pitfall where the unsecured-JWS option defined in RFC 7515 is meant to be explicitly opt-in, but a verifier that does not enforce an algorithm allowlist treats an unsigned token as authentic. The affected CPE is cpe:2.3:a:authlib:authlib, confirming the library itself (not a specific downstream product) is the vulnerable component.
Know when Authlib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Network-reachable, low-complexity forged token requires no privileges or interaction; impact is integrity/authentication bypass only, with no confidentiality or availability loss.
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
9DescriptionCVE.org
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
Executive ViewAI
Authlib versions 1.6.5-1.6.6 contain a JWT signature verification bypass that allows unauthenticated attackers to forge identity tokens, potentially enabling account takeover across any application using these versions. Immediate patching is critical as the bypass is trivial to exploit despite current low-detection metrics.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Authlib is a Python library which builds OAuth and OpenID Connect servers. [CVSS 5.7 MEDIUM]
Authlib is a Python library which builds OAuth and OpenID Connect servers. Rated high severity (CVSS 7.5), this vulnerab
Authlib's JOSE/JWS verification path (through 1.6.4, with 1.6.5 as the fix) decodes attacker-supplied JWT/JWS header and
lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Rated high severity (CVSS 7.5), this v
Memory exhaustion in joserfc before 1.7.6 allows remote unauthenticated attackers to force a roughly token-sized extra a
Unbounded DEFLATE decompression in Authlib's JWE zip=DEF handling (authlib/jose/rfc7518/jwe_zips.py) lets a small, valid
Signature verification bypass in Authlib 1.7.2 and earlier allows unauthenticated remote attackers to have crafted JWS J
Poisoned OAuth/OIDC discovery metadata in Authlib 1.7.2 and earlier allows an attacker who controls or intercepts the me
Server-side request forgery in Authlib's RFC 9101 JWTAuthenticationRequest (JAR) extension lets unauthenticated remote a
Resource exhaustion in joserfc (versions 1.3.4-1.6.5) is possible because the RFC7797 unencoded-payload (b64=false) JWS
Token forgery in the Authlib Python library before 1.9.1 lets a remote, unauthenticated attacker mint HS256, HS384 or HS
JWT signature-verification bypass in the Python Authlib library (1.3.1 through 1.8.0) lets a remote attacker who knows o
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Desktop 15 SP7 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Fixed |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 15 SP7 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Fixed |
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Fixed |
| SUSE Linux Enterprise Desktop 15 SP6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Fixed |
Exploit-DB