Junglewise Threat Intelligence

CVE-2026-28802: Authlib signature verification bypass via none algorithm in JWT

CVE-2026-28802 · Severity: critical · CVSS 9.8 · Published 2026-03-06

Technologies: authlib (PyPI), Red Hat Ansible Automation Platform. Vendors: Red Hat, PyPI, Authlib.

Executive brief

Authlib, a Python library used to build secure login and identity services, contains a flaw that allows attackers to bypass security checks. By sending a specially crafted digital token with no signature, an attacker can impersonate users or gain administrative access to applications. This could lead to unauthorized data access, account takeovers, and full compromise of systems relying on the library for authentication.

Technical details

Authlib versions 1.6.5 and 1.6.6 contain a vulnerability where the library incorrectly validates JSON Web Tokens (JWTs) that specify 'alg: none' in the header. Specifically, the signature verification step returns true if the signature is empty, rather than rejecting the insecure algorithm by default. A remote, unauthenticated attacker can exploit this by crafting a malicious JWT with a 'none' algorithm and an empty signature to bypass authentication or forge identity claims (e.g., setting a 'role' to 'admin'). This issue affects applications using Authlib's JOSE and JWT modules for OAuth or OpenID Connect implementations. The vulnerability is patched in version 1.6.7 by removing 'none' from the default allowed algorithms and ensuring proper signature checks.

Affected products

  • Authlib Authlib >= 1.6.5, < 1.6.7
  • Red Hat Red Hat Quay 3.9, 3.10, 3.12, 3.15, 3.16
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Satellite 6

Timeline

  • 2026-03-04: advisory: GitHub Security Advisory published by maintainers
  • 2026-03-06: disclosed: CVE published to NVD
  • 2026-03-06: patched: Authlib version 1.6.7 released
  • 2026-05-19: patched: Red Hat released security updates for affected products

References

Related threats