7.7
High
CVE-2026-28802 Authlib is a Python library which builds OAuth and OpenID Connect servers
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.6 1774417022 | earliest → < 1774417022 | 1774417022 |
| Red Hat Quay 3.12 1773771962 | earliest → < 1773771962 | 1773771962 |
| Red Hat Quay 3.15 1775169219 | earliest → < 1775169219 | 1775169219 |
| Red Hat Quay 3.16 1779204086 | earliest → < 1779204086 | 1779204086 |
| Red Hat Quay 3.1 1773971077 | earliest → < 1773971077 | 1773971077 |
| Red Hat Quay 3.9 1773936323 | earliest → < 1773936323 | 1773936323 |
| Red Hat Satellite 6 | Versions not published | |
| authlib 1.6 | 1.6.5 → < 1.6.7 | 1.6.7 |
| Red Hat Quay 3.10 1773971077 | earliest → < 1773971077 | 1773971077 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2.6
The 106 CVEs of Red Hat Ansible Automation Platform 2.6 →
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
High
CVE-2026-90959
A path traversal vulnerability was found in pulpcore
8.1
High
CVE-2026-84724
Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process
6.6
Medium
CVE-2026-84720
Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle
6.5
Medium