7.7
Élevée
CVE-2026-28802 Authlib is a Python library which builds OAuth and OpenID Connect servers
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Ansible Automation Platform 2.6 1774417022 | premières → < 1774417022 | 1774417022 |
| Red Hat Quay 3.12 1773771962 | premières → < 1773771962 | 1773771962 |
| Red Hat Quay 3.15 1775169219 | premières → < 1775169219 | 1775169219 |
| Red Hat Quay 3.16 1779204086 | premières → < 1779204086 | 1779204086 |
| Red Hat Quay 3.1 1773971077 | premières → < 1773971077 | 1773971077 |
| Red Hat Quay 3.9 1773936323 | premières → < 1773936323 | 1773936323 |
| Red Hat Satellite 6 | Versions non publiées | |
| authlib 1.6 | 1.6.5 → < 1.6.7 | 1.6.7 |
| Red Hat Quay 3.10 1773971077 | premières → < 1773971077 | 1773971077 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Ansible Automation Platform 2.6
Les 106 CVE de Red Hat Ansible Automation Platform 2.6 →
CVE-2026-92982
A flaw was found in Ansible Operator Plugins
8.5
Élevée
CVE-2026-90959
A path traversal vulnerability was found in pulpcore
8.1
Élevée
CVE-2026-84724
Automation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process
6.6
Moyenne
CVE-2026-84720
Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle
6.5
Moyenne