CVSS 4.0
8.3 highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NCVE-2026-28490
High (8.3) in authlib authlib. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in authlib 1.6.9.
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.
Severity
CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-203, CWE-327
- Published
- Modified
- Record from
- the NVD, synced
Affected
- authlib:authlib
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7432-952r-cw78 | PyPI | authlib | <1.6.9 | 1.6.9 |
| PYSEC-2026-2116 | PyPI | authlib | <1.6.9 | 1.6.9 |