8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28498

CVE-2026-28498: Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28498

CVE-2026-28498:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
authlib	pip	<= 1.6.8	1.6.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a critical 'fail-open' design flaw in the Authlib library's OpenID Connect (OIDC) implementation. The root cause is in the _verify_hash function located in authlib/oidc/core/claims.py. This function is responsible for verifying the at_hash (Access Token hash) and c_hash (Authorization Code hash) claims in an ID Token.

The vulnerability is triggered when an attacker submits an ID Token where the JWT header's alg parameter specifies a cryptographic algorithm that is not supported by the underlying hashlib library. The helper function create_half_hash correctly returns None in this scenario. However, the vulnerable version of _verify_hash checks for this condition with if not hash_value:, which evaluates to true for None, and then proceeds to return True, effectively signaling that the hash verification has passed.

This allows an attacker to completely bypass the integrity check that binds the ID Token to the Access Token or Authorization Code. The public-facing methods IDToken.validate_at_hash and HybridIDToken.validate_c_hash call the vulnerable _verify_hash function, making them the primary entry points for exploitation in an application using Authlib. The patch corrects the logic to if hash_value is None: return False, enforcing a secure 'fail-closed' behavior as required by cryptographic best practices and OIDC specifications.

Vulnerable functions

_verify_hash

authlib/oidc/core/claims.py

This function contains the core logic flaw. It incorrectly interprets a `None` return value from `create_half_hash` (indicating an unsupported algorithm) as a successful validation, returning `True`. This 'fail-open' behavior allows the cryptographic verification of the `at_hash` and `c_hash` claims to be bypassed.

IDToken.validate_at_hash

authlib/oidc/core/claims.py

This method is a public API used to validate the `at_hash` claim, which binds an ID Token to an Access Token. It internally calls the vulnerable `_verify_hash` function. During an attack, this function would be called to validate a forged token. Because of the flaw in `_verify_hash`, the validation would pass silently, allowing an attacker to substitute a malicious access token.

HybridIDToken.validate_c_hash

authlib/oidc/core/claims.py

This method is a public API used in the OIDC Hybrid Flow to validate the `c_hash` claim, which binds an ID Token to an Authorization Code. It also relies on the flawed `_verify_hash` function. Exploitation would involve this function being called on a forged token, and due to the vulnerability, it would incorrectly approve the token, enabling an Authorization Code substitution attack.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.