Authlib: empty signatures validation in JWS JSON deserialization

Authlib prior to 1.9.0 contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key. Root caus...

CVE-2026-50634

A flaw was found in Apache CXF. The JwsJsonContainerRequestFilter component can be exploited to process metadata that has not been authenticated by an accepted signature. This bypasses the application's security assumption that Content-Type or protected HTTP-header metadata originates from a...

CVE-2026-50634

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted Content-Type or protected HTTP-header metadata came from a verified...

CVE-2026-50634

A vulnerability exists in Apache CXF 's JwsJsonContainerRequestFilter where the system may process metadata that has not been authenticated by the accepted signature. This flaw allows an attacker to bypass assumptions regarding verified Content-Type or protected HTTP-header metadata, potentially ...

CVE-2026-50634 Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry

A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application's assumption that accepted Content-Type or protected HTTP-header metadata came from a verified...