CVE-2026-28802
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Authlib versions 1.6.5 to 1.6.6 incorrectly passed malicious JWT tokens with 'alg: none' and an empty signature, bypassing signature verification. The issue is fixed in version 1.6.7.
Risk Assessment
An attacker can exploit this vulnerability to forge JWT tokens and gain unauthorized access to OAuth/OpenID Connect systems, potentially leading to account takeover or privilege escalation.
Recommendation
Immediately upgrade Authlib to version 1.6.7 or later. After upgrading, test the JWT verification mechanism in a non-production environment.
Original NVD description (English source)
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.