CVE-2026-28802: Authlib Vulnerability Allows Bypass of Signature Verification with alg: none

Background

Authlib is a popular Python library used for building OAuth and OpenID Connect clients and servers. It provides tools for handling JSON Web Tokens (JWTs), which are widely used for authentication and authorization in web applications. The library is designed to simplify the implementation of secure token-based authentication, but it has recently been found to have a significant vulnerability that could compromise its security.

Vulnerability Detail

The vulnerability arises from a flaw introduced in Authlib versions 1.6.0 and 1.6.5, where a JWT with the header 'alg: none' and an empty signature is incorrectly accepted during signature verification. This flaw allows attackers to create forged tokens that can bypass authentication checks, leading to potential unauthorized access, privilege escalation, and data modification. The issue was likely introduced in a specific commit, which altered the handling of JWT signatures without adequately addressing the security implications.

pip install --upgrade "authlib==1.6.7"

Workaround

As a temporary workaround, applications using Authlib should implement a check to disallow the use of 'alg: none' in JWT headers. This can be done by validating the JWT headers before processing them. Here is an example code snippet to illustrate this check:

from authlib.jose import jwt

def validate_jwt_header(token):
    header = jwt.get_unverified_header(token)
    if header.get('alg') == 'none':
        raise ValueError('Invalid JWT: alg: none is not allowed')
    return True

Conclusion

The Authlib vulnerability (CVE-2026-28802) poses a serious risk to applications relying on JWTs for authentication. Users are strongly advised to update to the patched version 1.6.7 or later and implement additional checks to ensure the security of their applications.

See every vulnerability recorded for authlib →

FAQ