جزئیات آسیب‌پذیری
CVE-2026-28498
Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
شرح رسمی (انگلیسی)
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.2بالا | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| 9.1بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Satellite 6 | همه | CVEProject cvelistV5 (CNA) |
| authlib | authlib | < 1.6.9 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱۲- https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j x_refsource_CONFIRM
- https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b x_refsource_MISC
- https://github.com/authlib/authlib/releases/tag/v1.6.9 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-28498 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2448182 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28498.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:6309 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6912 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6720 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6568 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6497 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6567 vendor-advisoryx_refsource_REDHAT
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۱۲/۲۵
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۱۹
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- اثبات مفهوم
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-354Improper Validation of Integrity Check Value
- CWE-573Improper Following of Specification by Caller
- CWE-325Missing Cryptographic Step