Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
Published: 2026-03-06
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Signature verification bypass via 'alg:none' JWT
Action: Update to 1.6.7
AI Analysis

Impact

A malicious JWT containing the algorithm field set to 'none' and an empty signature allows an attacker to bypass the signature verification step in Authlib. As a result, forged tokens can be accepted, providing the attacker with unauthorized access and the ability to impersonate other users. The flaw is classified as CWE-347, indicating broken authentication.

Affected Systems

Authlib library versions from 1.6.5 up to, but not including, 1.6.7 are affected. Applications that use these versions to validate OAuth or OpenID Connect tokens are at risk.

Risk and Exploitability

The vulnerability has a CVSS score of 7.7, indicating high severity. Its EPSS score is less than 1%, signifying a low likelihood of exploitation at present, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a JWT with 'alg:none' and no signature, which can then be processed by any application that relies on Authlib without additional checks.

Generated by OpenCVE AI on April 16, 2026 at 11:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Authlib to version 1.6.7 or newer.
  • Configure the application to reject any JWT whose algorithm is 'none' and require a valid signature for all tokens.
  • Audit the JWT handling code to enforce a strict list of accepted algorithms and enable signature verification.

Generated by OpenCVE AI on April 16, 2026 at 11:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7wc2-qxgw-g8gg Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
History

Mon, 09 Mar 2026 21:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Fri, 06 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Authlib
Authlib authlib
Vendors & Products Authlib
Authlib authlib

Fri, 06 Mar 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

threat_severity

Important

Fri, 06 Mar 2026 07:00:00 +0000

Type Values Removed Values Added
Description Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
Title Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
Weaknesses CWE-347
References
Metrics cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Authlib Authlib
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-06T16:05:35.082Z

Reserved: 2026-03-03T14:25:19.246Z

Link: CVE-2026-28802

cve-icon Vulnrichment

Updated: 2026-03-06T16:00:06.142Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-06T07:16:01.053

Modified: 2026-03-09T21:20:56.980

Link: CVE-2026-28802

cve-icon Redhat

Severity : Important

Publid Date: 2026-03-06T06:44:26Z

Links: CVE-2026-28802 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T11:45:26Z

Weaknesses