CVE-2026-96760

Authlib 1.7.2 and earlier has a signature-verification bypass in JsonWebSignature.deserialize_json(). The method accepts a JSON Serialization JWS and returns the payload as if it had been successfully verified, without checking a signature and without requiring a cryptographic key. An attacker who can supply a JWS to an application that trusts this method can present an unsigned or forged payload as authentic, which can lead to authentication or authorization bypass depending on how the application uses the payload. Any product or service that relies on Authlib at version 1.7.2 or below and verifies JSON Serialization JWS objects through this method is affected. The issue is not listed in CISA KEV, no public proof-of-concept is known, and exploitation in the wild has not been reported.

What to do: Upgrade Authlib to a release newer than 1.7.2 as soon as a fixed version is available from the project, and treat every JSON Serialization JWS accepted through JsonWebSignature.deserialize_json() as unverified until then. Audit applications that pass untrusted JWS to that method and require verification with an API that demands a cryptographic key. There is no public fix version in the advisory data, so confirm the patched release against the Authlib or CERT advisory before deploying.