agentstack-cli (>=0.5.0rc4, <=0.6.2), aieng-platform-onboard (>=0.5.0, <=0.6.1) +34 more potentially affected by CVE-2026-28802 via authlib (>=1.6.5, <=1.6.6)

authlib PYPI version =1.6.5, =0.5.0rc4, =0.5.0, =0.21.0, =0.44.0, =1.7.0, =0.8.0, =1.0.20, =0.12.0, =1.0.3, =0.2.0, =1.0.0, =1.115.2, =0.2.20, =1.0.0, =26.0.0, =26.0.1 and more Source cves: CVE-2026-28802 Source advisory: OSV:PYSEC-2026-2118...

CVE-2026-28802

Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application co...