CVE-2026-28802Critical· 9.8▾ MidnightAuthlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
authlib >= 1.6.5, < 1.6.7Upgrade past the affected range:
authlib 1.6.7Affected packages:
authlib >= 1.6.5, < 1.6.7Patched in:
authlib 1.6.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27962Critical· 9.1Authlib is a Python library which builds OAuth and OpenID Connect servers
CVE-2026-28498High· 7.5Authlib is a Python library which builds OAuth and OpenID Connect servers
CVE-2025-61920High· 7.5Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
CVE-2026-32597High· 7.5PyJWT is a JSON Web Token implementation in Python
CVE-2026-4600High· 7.4Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509 verification flow in src/ds…
CVE-2026-44681Medium· 6.1Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect