VU#762428: Authlib library contains a signature‑verification bypass vulnerability
Authlib through 1.7.2 can accept unsigned JWS payloads, enabling authentication bypass via CVE-2026-96760.
CERT/CC says Authlib through version 1.7.2 contains a JSON Web Signature verification bypass tracked as CVE-2026-96760. JsonWebSignature.deserialize_json() treats a JWS whose signatures array is empty as successfully verified, and jws.deserialize() is also affected, so forged content can be accepted without any signing key. Systems using Authlib for authentication, authorization, or inter-service integrity may honor attacker-supplied claims such as roles or scopes. The vendor was not reached, and no official patch was available when the note was published on September 28, 2026.
- Authlib 1.7.2 and earlier accept JWS objects with an empty signatures array.
- CVE-2026-96760 lets attackers forge trusted payloads without key material.
- Both deserialize_json() and deserialize() are affected.
- No vendor patch was available; users should monitor the GitHub repository.
- CVEs
- CVE-2026-96760
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-96760 | Signature verification bypass in Authlib 1.7.2 and earlier | 9.8 | <1% | PoC |
From the original article
2 min read at kb.cert.orgOverview Authlib (versions up to and including 1. 7. 2) contain a signature‑verification bypass in the JSON Web Signature (JWS) general JSON serialization handling.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.