Detections
Analytics

Debian dla-4708 : python-authlib-doc - security update

high Nessus Plugin ID 331518

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4708 advisory.

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4708-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura July 31, 2026 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : python-authlib Version : 0.15.4-1+deb11u4 1.2.0-1+deb12u2 CVE ID : CVE-2026-27962 CVE-2026-28490 CVE-2026-28498 CVE-2026-41425 CVE-2026-44681

 The following security issue has been identified (and fixed) in python-authlib as shipped in Debian bullseye and Debian bookworm.

 CVE-2026-44681

 An unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorisation endpoint allowed a remote attacker to cause the authorisation server to issue an HTTP 302 to an attacker-chosen URL by submitting an authorisation request that omits the openid scope.

 For Debian 11 bullseye, this problem has been fixed in version 0.15.4-1+deb11u4.

 In addition, the following issues have been fixed in the python-authlib version as shipped in Debian bookworm:

 CVE-2026-27962

 Fix authentication and authorization bypass vulnerability by embedding a crafted public key in the jwk header field when key=None is passed to JWS deserialisation functions.

 CVE-2026-28490

 Authlib exposed distinguishable error responses between invalid PKCS#1 v1.5 padding and invalid AES-GCM tag, enabling Bleichenbacher-style attacks.

 CVE-2026-28498

 Fix OIDC ID Token validation bypass in at_hash and c_hash verification.
 _verify_hash() silently returned True when create_half_hash() received an unknown algorithm, allowing forged ID Tokens to pass validation.

 CVE-2026-41425

 CSRF protection now covers the cache feature in authlib.integrations.starlette_client.OAuth as well.

 For Debian 12 bookworm, these problems have been fixed in version 1.2.0-1+deb12u2.

 We recommend that you upgrade your python-authlib packages.

 For the detailed security status of python-authlib please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/python-authlib

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the python-authlib-doc packages.

See Also

https://packages.debian.org/source/bookworm/python-authlib

https://packages.debian.org/source/bullseye/python-authlib

https://security-tracker.debian.org/tracker/CVE-2026-27962

https://security-tracker.debian.org/tracker/CVE-2026-28490

https://security-tracker.debian.org/tracker/CVE-2026-28498

https://security-tracker.debian.org/tracker/CVE-2026-41425

https://security-tracker.debian.org/tracker/CVE-2026-44681

http://www.nessus.org/u?1ee877aa

Plugin Details

Severity: High

ID: 331518

File Name: debian_DLA-4708.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 7/31/2026

Updated: 7/31/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.39

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2026-28498

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-28490

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:python-authlib-doc, p-cpe:/a:debian:debian_linux:python3-authlib

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/31/2026

Vulnerability Publication Date: 3/16/2026

Reference Information

CVE: CVE-2026-27962, CVE-2026-28490, CVE-2026-28498, CVE-2026-41425, CVE-2026-44681