Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-28498

28
FAUCET Score

CVE-2026-28498 describes a high-severity vulnerability in the Authlib Python library, affecting versions prior to 1.6.9, where its OpenID Connect (OIDC) ID Token validation fails open. This flaw allows an attacker to bypass integrity checks by providing a forged ID Token with an unrecognized cryptographic algorithm in the 'alg' header, which the library silently accepts. Rated 7.5 HIGH on CVSS, it has a network attack vector with low complexity and no user interaction, leading to high integrity impact. There is currently no evidence of active exploitation, nor are public exploit codes available, and community attention remains low.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.6.9CPE matchmatch criteria
cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

8.2HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
HIGH
VS Availability
NONE
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.23%
Probability of exploitation in next 30 days
EPSS Percentile
13.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0023 is in the 1st percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

github_advisorypatch availablevia nvd_reference
View patch
pippatch availablevia ghsa
Product: authlibFixed in: 1.6.9
ubuntupatch availablevia ubuntu_usn
Product: python-authlib (jammy)Fixed in: 0.15.5-1ubuntu0.1~esm2
ubuntupatch availablevia ubuntu_usn
Product: python-authlib (noble)Fixed in: 1.3.0-1ubuntu0.1~esm2
ubuntupatch availablevia ubuntu_usn
Product: python-authlib (resolute)Fixed in: 1.6.7-1ubuntu0.1~esm1

Vendor Advisories (2)

ubuntuUSN-8557-1

Authlib vulnerabilities

Jul 16, 2026
pipGHSA-m344-f55w-2m6jhigh

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

Mar 16, 2026

References

access.redhat.com / errata/RHSA-2026:6309
access.redhat.com / errata/RHSA-2026:6497
access.redhat.com / errata/RHSA-2026:6567
access.redhat.com / errata/RHSA-2026:6568
access.redhat.com / errata/RHSA-2026:6720
access.redhat.com / errata/RHSA-2026:6912
access.redhat.com / security/cve/CVE-2026-28498
bugzilla.redhat.com / show_bug.cgi
security.access.redhat.com / data/csaf/v2/vex/2026/cve-2026-28498.json
github.com / authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
Patch
github.com / authlib/authlib/releases/tag/v1.6.9
ProductRelease Notes
github.com / authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
ExploitMitigationVendor Advisory