Skip to content
fr Sign in
8.2 High

CVE-2026-28498 Authlib is a Python library which builds OAuth and OpenID Connect servers

Description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.

Affected products and versions

Product Affected versions Fixed in
Red Hat Ansible Automation Platform 2.6 1774417022 earliest → < 1774417022 1774417022
Red Hat Quay 3.12 1775253092 earliest → < 1775253092 1775253092
Red Hat Quay 3.15 1775169219 earliest → < 1775169219 1775169219
Red Hat Quay 3.16 1775169226 earliest → < 1775169226 1775169226
Red Hat Quay 3.16 1775069491 earliest → < 1775069491 1775069491
Red Hat Quay 3.1 1775169155 earliest → < 1775169155 1775169155
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Satellite 6 Versions not published
Lightspeed Core Versions not published
Show the 3 other branches
Product Affected versions Fixed in
Red Hat OpenShift AI (RHOAI) Versions not published
authlib 1.6 earliest → < 1.6.9 1.6.9
Red Hat Quay 3.10 1775169155 earliest → < 1775169155 1775169155

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Ansible Automation Platform 2.6

The 106 CVEs of Red Hat Ansible Automation Platform 2.6 →
CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 High CVE-2026-90959 A path traversal vulnerability was found in pulpcore 8.1 High CVE-2026-84724 Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process 6.6 Medium CVE-2026-84720 Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle 6.5 Medium
Track this CVE