CVE-2026-28490: authlib Observable Discrepancy
Vulnerability summary
CVE-2026-28490 is a high (CVSS 8.3) Observable Discrepancy vulnerability in authlib. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 16-03-2026PublishedVulnerability first disclosed.
- 16-03-2026Last modifiedVulnerability information updated.
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.3HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
+0.02 pp
From 0.14% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAuthlib
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Authlib1 product
- authlib< 1.6.9
Debian1 product
- python-authlib< 1.2.0-1+deb12u2 | All versions (No fix recorded) | < 1.6.9-1
PyPI1 product
- authlib< 1.6.9
Ubuntu1 product
- python-authlib< 0.15.5-1ubuntu0.1~esm2 | < 1.3.0-1ubuntu0.1~esm2 | All versions (No fix recorded) | < 1.6.7-1ubuntu0.1~esm1
4 vendors · 4 products
References
9 links- github.com/authlib/authlib/security/advisories/GHSA-7432-952r-cw78X Refsource CONFIRMWEBEVIDENCEREPORTExploitMitigationVendor Advisory
- github.com/authlib/authlib/commit/48b345f29f6c459f11c6a40162b6c0b742ef2e22X Refsource MISCWEBFIXPatch
- github.com/authlib/authlibPACKAGE
