CVE-2026-28498

Что произошло

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "< 1.6.9"
}

{
  "status": "unaffected",
  "version": "1774417022",
  "lessThan": "*",
  "versionType": "rpm"
}

cpe:/a:redhat:ansible_automation_platform:2.6::el9

{
  "status": "unaffected",
  "version": "1775169155",
  "lessThan": "*",
  "versionType": "rpm"
}

cpe:/a:redhat:quay:3.10::el8

{
  "status": "unaffected",
  "version": "1775253092",
  "lessThan": "*",
  "versionType": "rpm"
}

cpe:/a:redhat:quay:3.12::el8

{
  "status": "unaffected",
  "version": "1775169219",
  "lessThan": "*",
  "versionType": "rpm"
}

cpe:/a:redhat:quay:3.15::el8

{
  "status": "unaffected",
  "version": "1775069491",
  "lessThan": "*",
  "versionType": "rpm"
}

{
  "status": "unaffected",
  "version": "1775169226",
  "lessThan": "*",
  "versionType": "rpm"
}

cpe:/a:redhat:quay:3.16::el9

cpe:/a:redhat:lightspeed_core

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:satellite:6

{
  "status": "affected",
  "version": "*",
  "versionEndExcluding": "1.6.9"
}

CVSS: оценки и векторы

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Источники и ссылки

{
  "cwes": [
    "cve"
  ],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-04T21:16:12.454897+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T19:04:03.040858+00:00"
  },
  "scores": [
    "cve"
  ],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T19:04:03.040858+00:00"
  },
  "affected": [
    "cve",
    "osv"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T19:04:03.040858+00:00"
  },
  "solutions": [
    "cve"
  ],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-04T21:16:12.454897+00:00"
  },
  "references": [
    "cve",
    "osv"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T19:04:03.040858+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены05.11.2026, 00:16
2. Данные обновлены04.11.2026, 00:12
3. Данные обновлены03.11.2026, 00:12
4. Появились сведения об исправлении02.11.2026, 15:11
5. Данные обновлены02.11.2026, 15:04
6. Данные обновлены02.11.2026, 00:10
7. Данные обновлены31.10.2026, 11:57
8. Данные обновлены29.10.2026, 12:21
9. Опубликована28.10.2026, 22:04

Личная заметка и статус

Другие CVE того же продукта