Authlib's JWE RSA1_5 implementation improperly handles PKCS#1 v1.5 padding errors by raising a distinct ValueError exception when the decrypted content encryption key (CEK) length is invalid. The underlying cryptography library correctly mitigates Bleichenbacher attacks by returning randomized bytes on invalid padding without raising exceptions. Authlib's length check breaks this mitigation by triggering a distinct exception before AES-GCM tag validation, creating an exception oracle with two distinguishable error paths: one for invalid padding and one for valid padding but invalid MAC. This oracle is exploitable in default configurations of popular Python web frameworks (Flask, Django, FastAPI) due to distinguishable HTTP responses. The root cause is the explicit length check and exception raise in Authlib's unwrap method. Removing this exception and silently handling the random CEK bytes eliminates the oracle. The vulnerability affects Authlib versions >=0.40 and <1.17.0 and was empirically confirmed on Authlib 1.6.8 and cryptography 46.0.5.

The vulnerability allows an attacker to distinguish between invalid padding and invalid MAC errors via exception differences, creating a Bleichenbacher padding oracle. This can potentially be exploited to decrypt RSA-encrypted content encryption keys in JWE tokens, undermining the confidentiality of encrypted data. The issue is present by default in Authlib installations and can be exploited without special configuration due to default behavior in common Python web frameworks that expose distinguishable error responses.

A patch is available for this vulnerability. Users should upgrade Authlib to version 1.17.0 or later where the exception oracle is eliminated by removing the explicit CEK length check and exception raise. Until patched, the vulnerability remains active by default. No additional mitigations are noted in the vendor advisory. Users should apply the official fix to prevent exploitation.