Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-96760

Authlib library contains a signature‑verification bypass vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
certcc

Description

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Authlib Authlib

  • 1.7.2affected

References