CVE-2026-28498
2 advisories.
PyPI/authlib CVE-2026-28498: high
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
Action: Upgrade authlib to 1.6.9 or later.
pip install authlib==1.6.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.9 | - |
Fixed versions
| 1.6.9 |
Sources
- osv: GHSA-m344-f55w-2m6j
- https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
- https://nvd.nist.gov/vuln/detail/CVE-2026-28498
- https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
- https://github.com/authlib/authlib
- https://github.com/authlib/authlib/releases/tag/v1.6.9
CVE-2026-28498 · published · modified · JSON
PyPI/authlib CVE-2026-28498: high 7.5
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation
Action: Upgrade authlib to 1.6.9 or later.
pip install authlib==1.6.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.9 | - |
Fixed versions
| 1.6.9 |
Sources
- osv: PYSEC-2026-2117
- https://access.redhat.com/security/cve/CVE-2026-28498
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28498.json
- https://access.redhat.com/errata/RHSA-2026:6309
- https://access.redhat.com/errata/RHSA-2026:6497
- https://access.redhat.com/errata/RHSA-2026:6567
- https://access.redhat.com/errata/RHSA-2026:6568
- https://access.redhat.com/errata/RHSA-2026:6720
- https://access.redhat.com/errata/RHSA-2026:6912
- https://github.com/authlib/authlib/releases/tag/v1.6.9
- https://bugzilla.redhat.com/show_bug.cgi?id=2448182
- https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
- https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
CVE-2026-28498 · published · modified · JSON