CVE-2026-28802Critical· 9.8▾ MidnightAuthlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.6%
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.
authlib >= 1.6.5, < 1.6.7Upgrade past the affected range:
authlib 1.6.7Affected packages:
authlib >= 1.6.5, < 1.6.7Patched in:
authlib 1.6.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27962Critical· 9.1Authlib is a Python library which builds OAuth and OpenID Connect servers
CVE-2026-96760Critical· 9.8Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability
CVE-2026-114616High· 7.4Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
CVE-2026-114617Medium· 4.2Authlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-114620Medium· 5.4Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF