Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4wgd-2mpe-tyh3
Vulnerability ID VCID-4wgd-2mpe-tyh3
Aliases CVE-2026-28498
GHSA-m344-f55w-2m6j
Summary authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens
Status Published
Exploitability 0.5
Weighted Severity 8.2
Risk 4.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-325 Missing Cryptographic Step
CWE-354 Improper Validation of Integrity Check Value
CWE-573 Improper Following of Specification by Caller
System Score Found at
cvssv3 9.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28498.json
cvssv3.1 9.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv4 8.2 https://github.com/authlib/authlib
generic_textual HIGH https://github.com/authlib/authlib
cvssv4 8.2 https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
generic_textual HIGH https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
ssvc Track https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
cvssv4 8.2 https://github.com/authlib/authlib/releases/tag/v1.6.9
generic_textual HIGH https://github.com/authlib/authlib/releases/tag/v1.6.9
ssvc Track https://github.com/authlib/authlib/releases/tag/v1.6.9
cvssv4 8.2 https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
generic_textual HIGH https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
ssvc Track https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
cvssv4 8.2 https://nvd.nist.gov/vuln/detail/CVE-2026-28498
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-28498
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28498.json
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28498
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/authlib/authlib
https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
https://github.com/authlib/authlib/releases/tag/v1.6.9
https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
https://nvd.nist.gov/vuln/detail/CVE-2026-28498
2448182 https://bugzilla.redhat.com/show_bug.cgi?id=2448182
RHSA-2026:6309 https://access.redhat.com/errata/RHSA-2026:6309
RHSA-2026:6404 https://access.redhat.com/errata/RHSA-2026:6404
RHSA-2026:6497 https://access.redhat.com/errata/RHSA-2026:6497
RHSA-2026:6567 https://access.redhat.com/errata/RHSA-2026:6567
RHSA-2026:6568 https://access.redhat.com/errata/RHSA-2026:6568
RHSA-2026:6720 https://access.redhat.com/errata/RHSA-2026:6720
RHSA-2026:6912 https://access.redhat.com/errata/RHSA-2026:6912
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28498.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/authlib/authlib
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-16T18:14:21Z/ Found at https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/authlib/authlib/releases/tag/v1.6.9
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-16T18:14:21Z/ Found at https://github.com/authlib/authlib/releases/tag/v1.6.9
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-16T18:14:21Z/ Found at https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-28498
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-04T16:33:32.994745+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28498.json 38.6.0