Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-j4a6-4vvj-x3gq
Vulnerability ID VCID-j4a6-4vvj-x3gq
Aliases CVE-2026-28498
GHSA-m344-f55w-2m6j
Summary
Status Published
Exploitability 0.5
Weighted Severity 8.2
Risk 4.1
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-354 Improper Validation of Integrity Check Value
CWE-573 Improper Following of Specification by Caller
CWE-325 Missing Cryptographic Step
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 9.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28498.json
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2026-28498
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2026-28498
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2026-28498
cvssv3.1 9.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-m344-f55w-2m6j
cvssv4 8.2 https://github.com/authlib/authlib
generic_textual HIGH https://github.com/authlib/authlib
cvssv4 8.2 https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
generic_textual HIGH https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
ssvc Track https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
cvssv4 8.2 https://github.com/authlib/authlib/releases/tag/v1.6.9
generic_textual HIGH https://github.com/authlib/authlib/releases/tag/v1.6.9
ssvc Track https://github.com/authlib/authlib/releases/tag/v1.6.9
cvssv3.1_qr HIGH https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
cvssv4 8.2 https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
generic_textual HIGH https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
ssvc Track https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
cvssv4 8.2 https://nvd.nist.gov/vuln/detail/CVE-2026-28498
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-28498
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28498.json
https://api.first.org/data/v1/epss?cve=CVE-2026-28498
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28498
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/authlib/authlib
https://nvd.nist.gov/vuln/detail/CVE-2026-28498
2448182 https://bugzilla.redhat.com/show_bug.cgi?id=2448182
b9bb2b25bf8b7e01512d847a95c1749646eaa72b https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
GHSA-m344-f55w-2m6j https://github.com/advisories/GHSA-m344-f55w-2m6j
GHSA-m344-f55w-2m6j https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
RHSA-2026:6309 https://access.redhat.com/errata/RHSA-2026:6309
RHSA-2026:6404 https://access.redhat.com/errata/RHSA-2026:6404
RHSA-2026:6497 https://access.redhat.com/errata/RHSA-2026:6497
RHSA-2026:6567 https://access.redhat.com/errata/RHSA-2026:6567
RHSA-2026:6568 https://access.redhat.com/errata/RHSA-2026:6568
RHSA-2026:6720 https://access.redhat.com/errata/RHSA-2026:6720
RHSA-2026:6912 https://access.redhat.com/errata/RHSA-2026:6912
v1.6.9 https://github.com/authlib/authlib/releases/tag/v1.6.9
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-28498.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/authlib/authlib
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-16T18:14:21Z/ Found at https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/authlib/authlib/releases/tag/v1.6.9
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-16T18:14:21Z/ Found at https://github.com/authlib/authlib/releases/tag/v1.6.9
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-03-16T18:14:21Z/ Found at https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-28498
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.08907
EPSS Score 0.00029
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:14:06.859115+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 38.6.0