8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28490

CVE-2026-28490: Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28490

CVE-2026-28490:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
authlib	pip	<= 1.6.8	1.6.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a padding oracle attack within the JWE RSA1_5 implementation of the Authlib library. The detailed vulnerability description explicitly identifies the root cause in the unwrap method of the RSAAlgorithm class, located in authlib/jose/rfc7518/jwe_algs.py. The vulnerability is caused by a length check performed on the decrypted key (cek) immediately after decryption. When the underlying cryptography library detects invalid padding, it returns a block of random bytes (a standard Bleichenbacher mitigation). Authlib's unwrap function then checks the length of this random block, finds it doesn't match the expected key length, and raises a ValueError. This behavior creates a distinguishable exception from the InvalidTag error that occurs when padding is valid but the symmetric decryption fails. This difference in exceptions is a classic exception oracle, which allows an attacker to perform a Bleichenbacher-style attack to recover the encrypted key. The provided commit 48b345f29f6c459f11c6a40162b6c0b742ef2e22 is a mitigation that deprecates the vulnerable RSA1_5 algorithm by default, but the core flaw in the unwrap function's logic is the true source of the vulnerability.

Vulnerable functions

RSAAlgorithm.unwrap

authlib/jose/rfc7518/jwe_algs.py

The 'unwrap' function in the 'RSAAlgorithm' class is vulnerable to a padding oracle attack. When decrypting a JWE with invalid PKCS#1 v1.5 padding, the underlying 'cryptography' library returns random bytes as a security measure. However, the 'unwrap' function checks the length of these bytes and raises a 'ValueError' if the length does not match the expected key size. This exception is different from the 'InvalidTag' exception raised for a valid padding but incorrect MAC, creating an observable difference (an exception oracle). An attacker can exploit this oracle to decrypt the Content Encryption Key (CEK) and any JWE payload encrypted with the 'RSA1_5' algorithm.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.