CVE-2026-28490: Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
Summary
CVE-2026-28490: Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle. Affects authlib versions < 1.6.9. Fixed in 1.6.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Authlib is a popular Python library that provides various utilities for building web applications, including support for OAuth 1, OAuth 2, and JSON Web Tokens (JWT). It simplifies the process of handling authentication and authorization in web applications. However, a significant vulnerability has been identified in its implementation of JSON Web Encryption (JWE) using the RSA1_5 key management algorithm, which is registered by default without requiring explicit opt-in from developers.
Vulnerability Detail
The vulnerability arises from a cryptographic padding oracle issue in Authlib's handling of the JWE RSA1_5 algorithm. When invalid PKCS#1 v1.5 padding is detected, Authlib raises a specific ValueError instead of allowing the underlying cryptography library to handle it in a constant-time manner. This creates an exception oracle, allowing attackers to distinguish between different types of errors based on the responses from the server. The ramifications include the potential for attackers to exploit this oracle to recover the content of encrypted messages, leading to unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.6.9
This is the first release that contains the fix.
pip install --upgrade "authlib==1.6.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can remove the RSA1_5 algorithm from the default JWE algorithm registry in their applications. This can be done by explicitly configuring the JWE instance to use a more secure algorithm, such as RSA-OAEP, instead of RSA1_5. Here is an example of how to configure JWE to use RSA-OAEP:
from authlib.jose import JsonWebEncryption
jwe = JsonWebEncryption()
jwe.register_algorithm('RSA-OAEP') # Register a secure algorithm
Conclusion
The vulnerability CVE-2026-28490 in Authlib poses a significant risk due to its cryptographic padding oracle issue. It is crucial for developers using Authlib to update to the patched version or implement the suggested workaround to protect their applications from potential exploitation.
See every vulnerability recorded for authlib →
FAQ
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to decrypt sensitive information or forge valid JWE tokens, leading to unauthorized access.
Yes, a patch is available in version 1.6.9 of Authlib. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, consider implementing the workaround by removing the RSA1_5 algorithm from the default registry and using a more secure alternative.
References
Related vulnerabilities
Recent vulnerabilities recorded for authlib.
