CVE-2026-28490 is a cryptographic padding oracle vulnerability found in the Authlib Python library, affecting versions prior to 1.6.9, specifically within its JSON Web Encryption (JWE) RSA1_5 key management algorithm. This flaw, rated Medium with a CVSS score of 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), could lead to high confidentiality impact and low integrity impact through a network-based attack, albeit with high attack complexity. There is no indication of active exploitation, and no public exploit code is available in common repositories like Metasploit or ExploitDB. Community discussion and media coverage are minimal, with a very low EPSS score, suggesting low current threat likelihood. Organizations using Authlib should update to version 1.6.9 or newer to patch this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.9CPE matchmatch criteria | cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.