Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was expected.. This issue has been patched in version 1.6.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before
    version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty
    signature was passing the signature verification step without any changes to the application code when a
    failure was expected.. This issue has been patched in version 1.6.7. (CVE-2026-28802)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before     version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty     signature was passing the signature verification step without any changes to the application code when a     failure was expected.. This issue has been patched in version 1.6.7. (CVE-2026-28802)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461300	Echo: authlib: security update to 1.6.6+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
461300	Echo: authlib: security update to 1.6.6+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
301403	Linux Distros Unpatched Vulnerability : CVE-2026-28802	Nessus	Misc.	Local	high
438408	SCA: security update for authlib (GHSA-7wc2-qxgw-g8gg)	Tenable Cloud Security	SCA Checks	Local	high
438408	SCA: security update for authlib (GHSA-7wc2-qxgw-g8gg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-28802

high

Tenable Plugins

high

high

high

high

high