CVE-2026-28490
Fixed in a distro release EPSS <1%CVSS 8.3
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.
Products: authlib
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | authlib | 1.6.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-authlib | 1.2.0-1+deb12u2 |
| Debian 13 | python-authlib | no fix |
| Debian 14 | python-authlib | 1.6.9-1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-Authlib | 1.3.1-150600.3.17.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | python-Authlib | 1.3.1-150600.3.17.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | python-Authlib | 1.3.1-150600.3.17.1 |
| Ubuntu 25.10 | python-authlib | no fix |
| Ubuntu 26.10 | python-authlib | no fix |
| Ubuntu Pro 22.04 LTS | python-authlib | 0.15.5-1ubuntu0.1~esm2 |
| Ubuntu Pro 24.04 LTS | python-authlib | 1.3.0-1ubuntu0.1~esm2 |
| Ubuntu Pro 26.04 LTS | python-authlib | 1.6.7-1ubuntu0.1~esm1 |
| openSUSE Leap 15.6 | python-Authlib | 1.3.1-150600.3.17.1 |
| openSUSE Leap 16.0 | python-Authlib | 1.5.2-bp160.3.1 |