Authlib up to 1.6.8 information exposure

Summaryinfo

A vulnerability, which was classified as problematic, was found in Authlib up to 1.6.8. This affects an unknown function. Executing a manipulation can lead to information exposure. The identification of this vulnerability is CVE-2026-28490. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Authlib up to 1.6.8. It has been declared as problematic. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a information exposure vulnerability. The CWE definition for the vulnerability is CWE-203. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-28490 since 02/27/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 302540 (Linux Distros Unpatched Vulnerability : CVE-2026-28490), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.6.9 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (302540). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Authlib

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8

Website

• Product: https://github.com/authlib/authlib/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion