PyPI/authlib CVE-2026-28498: high, EPSS 0.24%

Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

Action: Upgrade authlib to 1.6.9 or later.

pip install authlib==1.6.9

Affected

Fixed versions

Sources

• osv: GHSA-m344-f55w-2m6j
• https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
• https://nvd.nist.gov/vuln/detail/CVE-2026-28498
• https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
• https://github.com/authlib/authlib
• https://github.com/authlib/authlib/releases/tag/v1.6.9

CVE-2026-28498 · published 2026-03-16T16:15:06Z · modified 2026-07-13T07:26:18.508336668Z · JSON