https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:08:13 +0000 https://vulnerability.circl.lu/vuln/cve-2026-28490 <p><strong>Affected:</strong> authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.</p> <p><strong>Affected:</strong> authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.</p> https://vulnerability.circl.lu/vuln/cve-2026-28490 https://vulnerability.circl.lu/vuln/ghsa-7432-952r-cw78 <p><strong>Affected:</strong> PyPI: authlib</p> <p>## 1. Executive Summary</p> <p>A cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) `RSA1_5` key management algorithm. Authlib registers `RSA1_5` in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying `cryptography` library implements correctly.</p> <p>When `cryptography` encounters an invalid PKCS#1 v1.5 padding, it returns a randomized byte string instead of raising an exception — the correct behavior per RFC 3218 §2.3.2. Authlib ignores this contract and raises `ValueError(&#39;Invalid &#34;cek&#34; length&#39;)` immediately after decryption, before reaching AES-GCM tag validation. This creates a clean, reliable **Exception Oracle**:</p> <p>- **Invalid padding** → `cryptography` returns random bytes → Authlib length check fails → `ValueError: Invalid &#34;cek&#34; length` - **Valid padding, wrong MAC** → decryption succeeds → length check passes → AES-GCM fails → `InvalidTag`</p> <p>**This oracle is active by default in every Authlib installation without any special configuration by the developer or the attacker.** The three most widely used Python web frameworks — Flask, Django, and FastAPI — all expose distinguishable HTTP responses for these two exception classes in their default configurations, requiring no additional setup to exploit.</p> <p>**Empirically confirmed on authlib 1.6.8 + cryptography 46.0.5:** ``` [PADDING…</p> <p><strong>Affected:</strong> PyPI: authlib</p> <p>## 1. Executive Summary</p> <p>A cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) `RSA1_5` key management algorithm. Authlib registers `RSA1_5` in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying `cryptography` library implements correctly.</p> <p>When `cryptography` encounters an invalid PKCS#1 v1.5 padding, it returns a randomized byte string instead of raising an exception — the correct behavior per RFC 3218 §2.3.2. Authlib ignores this contract and raises `ValueError(&#39;Invalid &#34;cek&#34; length&#39;)` immediately after decryption, before reaching AES-GCM tag validation. This creates a clean, reliable **Exception Oracle**:</p> <p>- **Invalid padding** → `cryptography` returns random bytes → Authlib length check fails → `ValueError: Invalid &#34;cek&#34; length` - **Valid padding, wrong MAC** → decryption succeeds → length check passes → AES-GCM fails → `InvalidTag`</p> <p>**This oracle is active by default in every Authlib installation without any special configuration by the developer or the attacker.** The three most widely used Python web frameworks — Flask, Django, and FastAPI — all expose distinguishable HTTP responses for these two exception classes in their default configurations, requiring no additional setup to exploit.</p> <p>**Empirically confirmed on authlib 1.6.8 + cryptography 46.0.5:** ``` [PADDING…</p> https://vulnerability.circl.lu/vuln/ghsa-7432-952r-cw78 https://vulnerability.circl.lu/vuln/pysec-2026-2116 <p><strong>Affected:</strong> PyPI: authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.</p> <p><strong>Affected:</strong> PyPI: authlib</p> <p>Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant-time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9.</p> https://vulnerability.circl.lu/vuln/pysec-2026-2116