CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

EUVD-2026-88465

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760

The Authlib library (v1.7.2 and below) contains a signature verification bypass vulnerability within the JsonWebSignature.deserialize_json() method. When processing a JSON Serialization JWS object, the method returns the payload as successfully verified without validating a cryptographic signatur...

PT-2026-102339

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.7.3 Description An issue exists in the JWS general JSON serialization handler where the JsonWebSignature.deserialize json function accepts a JWS object with an empty signatures array and treats the payload as...

CVE-2026-96760: Improper Input Validation

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

Authlib library contains a signature‑verification bypass vulnerability

Overview Authlib versions up to and including 1.7.2 contain a signature‑verification bypass in the JSON Web Signature JWS general JSON serialization handling. The JsonWebSignature.deserializejson function accepts a JWS object with an empty "signatures" array and treats the payload as successfully...

The vulnerability of the OAuth authentication component for web applications based on the Starlette library, provided by the Authlib library for OAuth servers and OpenID Connect, allows a hacker to perform a CSRF attack.

The vulnerability of the OAuth authentication component for web applications based on the Starlette library, provided by the Authlib library for OAuth and OpenID Connect servers, is related to the manipulation of cross-site requests. Exploiting this vulnerability could allow a malicious actor to...

The vulnerability of the OpenIDImplicitGrant and OpenIDHybridGrant endpoints of the Authlib library for OAuth and OpenID Connect servers allows a hacker to redirect a user to any arbitrary URL address.

The vulnerability of the OpenIDImplicitGrant and OpenIDHybridGrant endpoints of the Authlib library for OAuth and OpenID Connect servers involves redirecting users to an unreliable website. Exploiting this vulnerability could allow a malicious actor to redirect users to any given URL address...

The vulnerability of the Authlib OAuth 2.0 library server against OAuth and OpenID Connect servers allows a hacker to redirect a user to any given URL address.

The vulnerability of the Authlib OAuth 2.0 library server for OAuth and OpenID Connect servers involves redirecting the URL to an unreliable website. Exploiting this vulnerability could allow a malicious actor to redirect users to any given URL address...

SUSE SLED15 / SLES15 Security Update : python-Authlib (SUSE-SU-2026:4111-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4111-1 advisory. This update for python-Authlib fixes the following issue: - CVE-2026-41479: crafted authorization requests with...

Security update for python-Authlib

This update for python-Authlib fixes the following issue: CVE-2026-41479: crafted authorization requests with unsupported responsetypes can cause unauthenticated open redirects bsc1275231. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:4111-1 Security update for python-Authlib

This update for python-Authlib fixes the following issue: - CVE-2026-41479: crafted authorization requests with unsupported responsetypes can cause unauthenticated open redirects bsc1275231...

openSUSE 16 Security Update : python-Authlib (openSUSE-SU-2026:21795-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21795-1 advisory. Changes in python-Authlib: - CVE-2026-41479: Open Redirect vulnerability via crafted authorization requests bsc1275231 Tenable has extracted the precedi...

Security update for python-Authlib (moderate)

openSUSE security update: security update for python-authlib ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21795-1 Rating: moderate References: bsc1275231 Cross-References: CVE-2026-41479 CVSS scores: CVE-2026-41479 SUSE : 5.4...

OPENSUSE-SU-2026:21795-1 Security update for python-Authlib

This update for python-Authlib fixes the following issues: Changes in python-Authlib: - CVE-2026-41479: Open Redirect vulnerability via crafted authorization requests bsc1275231...

python313-Authlib-1.7.2-3.1 on GA media (moderate)

python313-Authlib-1.7.2-3.1 on GA media Announcement ID: openSUSE-SU-2026:11614-1 Rating: moderate Cross-References: CVE-2024-37568 CVSS scores: CVE-2024-37568 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that solves one vulnerability ca...