CVE-2026-28802 in Authlib
Summary
by MITRE • 03/06/2026
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/01/2026
The vulnerability identified as CVE-2026-28802 affects the Authlib Python library, a widely-used component for implementing OAuth and OpenID Connect server functionality. This security flaw exists within the library's JWT (JSON Web Token) signature verification process and specifically impacts versions between 1.6.5 and 1.6.7. The issue stems from an insufficient validation mechanism that fails to properly handle JWTs with the algorithm set to "none" and empty signatures, creating a critical security gap in authentication systems that rely on this library. The vulnerability represents a direct violation of security principles where legitimate authentication tokens can bypass verification checks, potentially allowing unauthorized access to protected resources.
The technical flaw manifests in the signature verification logic where the library does not adequately enforce algorithm constraints during JWT validation. When a malicious JWT contains the header parameter alg: none alongside an empty signature, the vulnerable version of Authlib incorrectly accepts this token as valid instead of rejecting it with an appropriate error. This behavior directly relates to CWE-347, which addresses the lack of proper cryptographic verification mechanisms, and specifically targets weaknesses in authentication token validation processes. The flaw exploits the fact that JWTs with alg: none are explicitly intended to be used with no signature verification, but when such tokens are improperly accepted by a system that should require cryptographic signatures, they create a path for authentication bypass attacks.
The operational impact of this vulnerability is significant for any application using Authlib versions 1.6.5 through 1.6.6 that implement OAuth or OpenID Connect authentication. Attackers could craft malicious JWT tokens with alg: none and empty signatures, potentially gaining unauthorized access to protected resources, bypassing authentication mechanisms, and compromising user sessions. This vulnerability aligns with ATT&CK technique T1566, which covers social engineering through credential theft, and T1078, which addresses valid accounts usage. The flaw essentially allows attackers to exploit the trust relationship between authentication systems and tokens, potentially leading to full system compromise when combined with other attack vectors. Organizations relying on this library for authentication services face immediate risk of credential compromise and unauthorized access to sensitive data.
The remediation for this vulnerability requires updating to Authlib version 1.6.7 or later, which implements proper signature verification checks that reject JWTs with alg: none when cryptographic signatures are expected. Security teams should conduct immediate assessment of all systems using vulnerable Authlib versions to identify potential exploitation attempts and implement additional monitoring for suspicious authentication patterns. Organizations should also review their JWT validation configurations to ensure that systems properly enforce cryptographic signature requirements and implement proper logging of authentication attempts to detect potential exploitation of this vulnerability. The fix addresses the core issue by strengthening the algorithm validation process and ensuring that tokens with potentially dangerous configurations are properly rejected during the verification phase, thereby restoring the intended security posture of the authentication system.