Improper validation of integrity check value in authlib - CVE-2026-28498
Published: March 17, 2026
Vulnerability identifier: #VU124064
CSH Severity: High
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-28498
CWE-ID: CWE-354
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication checks.
The vulnerability exists due to an error in internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims, which exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. A remote attacker can bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter and bypass validation of OpenID Connect (OIDC) ID Tokens.
Affected software
authlib
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
Python 3 Module
openSUSE Leap
Ubuntu
python-authlib (Ubuntu package)
python311-Authlib
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
Python 3 Module
openSUSE Leap
Ubuntu
python-authlib (Ubuntu package)
python311-Authlib
How to mitigate CVE-2026-28498
Install updates from vendor's website.
authlib - update to 1.6.9
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm2, 1.3.0-1ubuntu0.1~esm2, 1.6.7-1ubuntu0.1~esm1
python311-Authlib - update to 1.3.1-150600.3.17.1
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm2, 1.3.0-1ubuntu0.1~esm2, 1.6.7-1ubuntu0.1~esm1
python311-Authlib - update to 1.3.1-150600.3.17.1