High 8.2Published Mar 16, 2026

CVE-2026-28498Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

Updated under an hour ago (Oct 27, 2026, 5:23 AM ET)

Does this affect you?

It affects authlib and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for authlib

Exploited in the last 30 days

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.

CVSS: 8.2 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-354, CWE-573, CWE-325
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Sep 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

authlib authlib authlib:authlib (from the name)	before 1.6.9	CNA record
Red Hat Red Hat Ansible Automation Platform 2.6 redhat:ansible_automation_platform	from 1774417022 not affected	CISA ADP
Red Hat Red Hat Quay 3.10 redhat:quay	from 1775169155 not affected	CISA ADP
Red Hat Lightspeed Core redhat:lightspeed_core	Versions not stated	CISA ADP
Red Hat Red Hat OpenShift AI (RHOAI) redhat:openshift_ai	Versions not stated	CISA ADP
Red Hat Red Hat Satellite 6 redhat:satellite	6	CISA ADP
authlib authlib authlib:authlib	before 1.6.9	NVD

References

References

https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j	x-refsource-confirm, exploit, mitigation, vendor-advisory
https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b	x-refsource-misc, patch
https://github.com/authlib/authlib/releases/tag/v1.6.9	x-refsource-misc, product, release-notes
https://access.redhat.com/errata/RHSA-2026:6309
https://access.redhat.com/errata/RHSA-2026:6497
https://access.redhat.com/errata/RHSA-2026:6567
https://access.redhat.com/errata/RHSA-2026:6568
https://access.redhat.com/errata/RHSA-2026:6720
https://access.redhat.com/errata/RHSA-2026:6912
https://access.redhat.com/security/cve/CVE-2026-28498
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.