CVE-2026-96760

A flaw was found in authlib. This flaw allows a remote attacker to bypass digital signature verification and submit forged data. When processing a JSON Web Signature JWS, a format used to verify data integrity, the deserializejson function marks payloads as successfully verified without validatin...

Authlib library contains a signature‑verification bypass vulnerability

Overview Authlib versions up to and including 1.7.2 contain a signature‑verification bypass in the JSON Web Signature JWS general JSON serialization handling. The JsonWebSignature.deserializejson function accepts a JWS object with an empty "signatures" array and treats the payload as successfully...