USN-8557-1: Authlib vulnerabilities

unknownCVE-2026-27962 CVE-2026-28490 CVE-2026-28498 CVE-2026-41425

Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded in JWT headers. An attacker could possibly use this issue to forge trusted tokens, resulting in authentication and authorization bypass. (CVE-2026-27962) Jay Neiva and Mauro Carrillo discovered that Authlib incorrectly handled RSA1_5 encrypted tokens. An attacker could possibly use this issue to recover sensitive encrypted information, resulting in information disclosure. (CVE-2026-28490) Jay Neiva and Mauro Carrillo discovered that Authlib did not properly reject unsupported cryptographic algorithms when validating OpenID Connect ID tokens. An attacker could possibly use this issue to bypass token integrity checks, resulting in authentication bypass. (CVE-2026-28498) Johnny Deuss discovered that Authlib did not provide cross-site request forgery protection for the OAuth cache feature in its Starlette integration. An attacker could possibly use this issue to perform unauthorized OAuth actions, resulting in cross-site request forgery. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-41425)

CSIRTS triage

vendor: null product: Authlib Authentication bypass Information disclosureCross-site request forgery

What: Multiple vulnerabilities in Authlib could allow attackers to forge tokens and bypass authentication.
Who is affected: Users of Authlib.
Urgency: Remediation is important to mitigate risks of token forgery and information disclosure.
Action: Review and apply updates as necessary.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Authlib

Get an email when a new Authlib advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-16
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8557-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-279620.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
Low exploitation riskCVE-2026-284900.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.
Low exploitation riskCVE-2026-284980.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
Low exploitation riskCVE-2026-414250.11% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-27962	coverage & exploitation status	NVD · CVE.org
CVE-2026-28490	coverage & exploitation status	NVD · CVE.org
CVE-2026-28498	coverage & exploitation status	NVD · CVE.org
CVE-2026-41425	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] Red Hat Ansible Automation Platform: Multiple vulnerabilitiescert-bund