Is CVE-2026-28802 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28802 being exploited in the wild.

How severe is CVE-2026-28802?

Critical severity, with a CVSS score of 9.8, published 6 March 2026.

Which products and versions are affected?

authlib (PyPI) ECOSYSTEM:introduced=1.6.5,fixed=1.6.7.

Is there a fix for CVE-2026-28802?

Yes. authlib (PyPI): upgrade to 1.6.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28802 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-28802?

Check whether you run authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28802: Authlib signature verification bypass via none algorithm in JWT

CVE-2026-28802 · Severity: critical · CVSS 9.8 · Published 2026-03-06

Authlib, a Python library used to build secure login and identity services, contains a flaw that allows attackers to bypass security checks. By sending a specially crafted digital token with no signature, an attacker can impersonate users or gain administrative access to applications. This could lead to unauthorized data access, account takeovers, and full compromise of systems relying on the library for authentication.

Technologies: authlib (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-28802 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28802 being exploited in the wild.
How severe is CVE-2026-28802?: Critical severity, with a CVSS score of 9.8, published 6 March 2026.
Which products and versions are affected?: authlib (PyPI) ECOSYSTEM:introduced=1.6.5,fixed=1.6.7.
Is there a fix for CVE-2026-28802?: Yes. authlib (PyPI): upgrade to 1.6.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28802 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-28802?: Check whether you run authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

authlib (PyPI): upgrade to 1.6.7 or later
```
pip install "authlib>=1.6.7"
```

Technical details

Authlib versions 1.6.5 and 1.6.6 contain a vulnerability where the library incorrectly validates JSON Web Tokens (JWTs) that specify 'alg: none' in the header. Specifically, the signature verification step returns true if the signature is empty, rather than rejecting the insecure algorithm by default. A remote, unauthenticated attacker can exploit this by crafting a malicious JWT with a 'none' algorithm and an empty signature to bypass authentication or forge identity claims (e.g., setting a 'role' to 'admin'). This issue affects applications using Authlib's JOSE and JWT modules for OAuth or OpenID Connect implementations. The vulnerability is patched in version 1.6.7 by removing 'none' from the default allowed algorithms and ensuring proper signature checks.

Affected products

Authlib Authlib >= 1.6.5, < 1.6.7
Red Hat Red Hat Quay 3.9, 3.10, 3.12, 3.15, 3.16
Red Hat Red Hat Ansible Automation Platform 2.6
Red Hat Red Hat Satellite 6

Identifiers

CVE-2026-28802
GHSA-7wc2-qxgw-g8gg
PYSEC-2026-2118

Timeline

2026-03-04: advisory: GitHub Security Advisory published by maintainers
2026-03-06: disclosed: CVE published to NVD
2026-03-06: patched: Authlib version 1.6.7 released
2026-05-19: patched: Red Hat released security updates for affected products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.