CVE-2026-28802

Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.

Affected products

Oauthlib, Red Os

Authlib

< 1.6.7

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

0.4% (35th percentile)

Weakness

CWE-347

NVD status

Modified

Published

2026-03-06

No exploit for CVE-2026-28802 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.