https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:04:40 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-04354 bdu:2026-04354 https://cve.radiocsirt.org/vuln/bdu:2026-04354 https://cve.radiocsirt.org/vuln/brew-fastmcp-cve-2026-28498 <p><strong>Affected:</strong> Homebrew: fastmcp</p> <p>## 1. Executive Summary</p> <p>A critical library-level vulnerability was identified in the **Authlib** Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (`_verify_hash`) responsible for validating the `at_hash` (Access Token Hash) and `c_hash` (Authorization Code Hash) claims exhibits a **fail-open** behavior when encountering an unsupported or unknown cryptographic algorithm.</p> <p>This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized `alg` header parameter. The library intercepts the unsupported state and silently returns `True` (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications.</p> <p>---</p> <p>## 2. Technical Details &amp; Root Cause</p> <p>The vulnerability resides within the `_verify_hash(signature, s, alg)` function in `authlib/oidc/core/claims.py`:</p> <p>```python def _verify_hash(signature, s, alg): hash_value = create_half_hash(s, alg) if not hash_value: # ← VULNERABILITY: create_half_hash returns None for unknown algorithms return True # ← BYPASS: The verification silently passes return hmac.compare_digest(hash_value, to_bytes(signature)) ```</p> <p>When an unsupported algorithm string (e.g., `&#34;XX999&#34;`) is processed by the helper function `create_half_hash` in `authlib/oidc/core/util.py`, the internal `getattr(hashlib, hash_type, None)` call fai…</p> <p><strong>Affected:</strong> Homebrew: fastmcp</p> <p>## 1. Executive Summary</p> <p>A critical library-level vulnerability was identified in the **Authlib** Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (`_verify_hash`) responsible for validating the `at_hash` (Access Token Hash) and `c_hash` (Authorization Code Hash) claims exhibits a **fail-open** behavior when encountering an unsupported or unknown cryptographic algorithm.</p> <p>This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized `alg` header parameter. The library intercepts the unsupported state and silently returns `True` (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications.</p> <p>---</p> <p>## 2. Technical Details &amp; Root Cause</p> <p>The vulnerability resides within the `_verify_hash(signature, s, alg)` function in `authlib/oidc/core/claims.py`:</p> <p>```python def _verify_hash(signature, s, alg): hash_value = create_half_hash(s, alg) if not hash_value: # ← VULNERABILITY: create_half_hash returns None for unknown algorithms return True # ← BYPASS: The verification silently passes return hmac.compare_digest(hash_value, to_bytes(signature)) ```</p> <p>When an unsupported algorithm string (e.g., `&#34;XX999&#34;`) is processed by the helper function `create_half_hash` in `authlib/oidc/core/util.py`, the internal `getattr(hashlib, hash_type, None)` call fai…</p> https://cve.radiocsirt.org/vuln/brew-fastmcp-cve-2026-28498 https://cve.radiocsirt.org/vuln/euvd-2026-366073 EUVD-2026-366073 https://cve.radiocsirt.org/vuln/euvd-2026-366073 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28498 <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28498 https://cve.radiocsirt.org/vuln/ghsa-m344-f55w-2m6j <p><strong>Affected:</strong> PyPI: authlib</p> <p>## 1. Executive Summary</p> <p>A critical library-level vulnerability was identified in the **Authlib** Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (`_verify_hash`) responsible for validating the `at_hash` (Access Token Hash) and `c_hash` (Authorization Code Hash) claims exhibits a **fail-open** behavior when encountering an unsupported or unknown cryptographic algorithm.</p> <p>This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized `alg` header parameter. The library intercepts the unsupported state and silently returns `True` (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications.</p> <p>---</p> <p>## 2. Technical Details &amp; Root Cause</p> <p>The vulnerability resides within the `_verify_hash(signature, s, alg)` function in `authlib/oidc/core/claims.py`:</p> <p>```python def _verify_hash(signature, s, alg): hash_value = create_half_hash(s, alg) if not hash_value: # ← VULNERABILITY: create_half_hash returns None for unknown algorithms return True # ← BYPASS: The verification silently passes return hmac.compare_digest(hash_value, to_bytes(signature)) ```</p> <p>When an unsupported algorithm string (e.g., `&#34;XX999&#34;`) is processed by the helper function `create_half_hash` in `authlib/oidc/core/util.py`, the internal `getattr(hashlib, hash_type, None)` call fai…</p> <p><strong>Affected:</strong> PyPI: authlib</p> <p>## 1. Executive Summary</p> <p>A critical library-level vulnerability was identified in the **Authlib** Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (`_verify_hash`) responsible for validating the `at_hash` (Access Token Hash) and `c_hash` (Authorization Code Hash) claims exhibits a **fail-open** behavior when encountering an unsupported or unknown cryptographic algorithm.</p> <p>This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized `alg` header parameter. The library intercepts the unsupported state and silently returns `True` (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications.</p> <p>---</p> <p>## 2. Technical Details &amp; Root Cause</p> <p>The vulnerability resides within the `_verify_hash(signature, s, alg)` function in `authlib/oidc/core/claims.py`:</p> <p>```python def _verify_hash(signature, s, alg): hash_value = create_half_hash(s, alg) if not hash_value: # ← VULNERABILITY: create_half_hash returns None for unknown algorithms return True # ← BYPASS: The verification silently passes return hmac.compare_digest(hash_value, to_bytes(signature)) ```</p> <p>When an unsupported algorithm string (e.g., `&#34;XX999&#34;`) is processed by the helper function `create_half_hash` in `authlib/oidc/core/util.py`, the internal `getattr(hashlib, hash_type, None)` call fai…</p> https://cve.radiocsirt.org/vuln/ghsa-m344-f55w-2m6j https://cve.radiocsirt.org/vuln/opensuse-su-2026:20392-1 <p>Security update for python-Authlib</p> <p>Security update for python-Authlib</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:20392-1 https://cve.radiocsirt.org/vuln/pysec-2026-2117 <p><strong>Affected:</strong> PyPI: authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.</p> <p><strong>Affected:</strong> PyPI: authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2117 https://cve.radiocsirt.org/vuln/rhsa-2026:6309 <p>aiohttp: AIOHTTP&#39;s HTTP Parser auto_decompress feature is vulnerable to zip bomb ajv: ReDoS via $data reference jsonpath: jsonpath: Arbitrary Code Execution via unsafe JSON Path expression evaluation axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access svgo: SVGO: Denial of Service via XML entity expansion express-rate-limit: express-rate-limit: Denial of Service for IPv4 clients due to incorrect IPv6 subnet masking pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion</p> <p>aiohttp: AIOHTTP&#39;s HTTP Parser auto_decompress feature is vulnerable to zip bomb ajv: ReDoS via $data reference jsonpath: jsonpath: Arbitrary Code Execution via unsafe JSON Path expression evaluation axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens authlib: Authlib: Signature verification bypass via malicious JWT allows unauthorized access svgo: SVGO: Denial of Service via XML entity expansion express-rate-limit: express-rate-limit: Denial of Service for IPv4 clients due to incorrect IPv6 subnet masking pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion</p> https://cve.radiocsirt.org/vuln/rhsa-2026:6309 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-28498 <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: python-authlib, Ubuntu:Pro:24.04:LTS: python-authlib, Ubuntu:25.10: python-authlib, Ubuntu:Pro:26.04:LTS: python-authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.</p> <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: python-authlib, Ubuntu:Pro:24.04:LTS: python-authlib, Ubuntu:25.10: python-authlib, Ubuntu:Pro:26.04:LTS: python-authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-28498 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0935 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0935