Vulnerability in Authlib

CVE-2026-28498

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Spe…

EPSS: 0.000 (8.8th percentile) — read the EPSS interpretation.

Affected products

Authlib — versions < 1.6.9

Weakness classification (CWE)

References

https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j (x_refsource_CONFIRM)
https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b (x_refsource_MISC)
https://github.com/authlib/authlib/releases/tag/v1.6.9 (x_refsource_MISC)