Cryptographic Padding Oracle Vulnerability in Authlib Python Library

CVE-2026-28490

What is CVE-2026-28490?

A cryptographic padding oracle vulnerability exists in the Authlib Python library before version 1.6.9 due to the insecure implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. This allows for the potential exploitation of the cryptographic operations, as Authlib mistakenly registers the RSA1_5 algorithm in its default algorithm registry without a necessary explicit opt-in from users. Moreover, it actively undermines the constant-time mitigation provided by the underlying cryptography library, leading to significant security risks. Users are encouraged to update to version 1.6.9 or later to ensure protection against such vulnerabilities.

References