CVE-2026-96760

Awaiting Analysis Awaiting Analysis - Queue

Authlib Signature Verification Bypass Vulnerability

Publication date: 2026-09-28

Last updated on: 2026-10-01

Assigner: CERT/CC

Description

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-10-01

Generated

2026-10-19

AI Q&A

2026-09-28

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96760

EUVD

EUVD-2026-88465

Affected Vendors & Products

Vendor	Product	Version / Range
authlib	authlib	to 1.7.3 (exc)
authlib	authlib	to 1.7.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-358	The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
CWE-670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

Authlib versions 1.7.2 and below contain a signature verification bypass flaw in the JsonWebSignature.deserialize_json() method. This method accepts a JSON Serialization JWS object and returns the payload as verified without checking for a signature or requiring a cryptographic key.

Detection Guidance

Check if your system uses Authlib versions 1.7.2 or below by inspecting installed packages. For Python, run: pip show authlib. If vulnerable, look for applications using JWS deserialization methods like jws.deserialize_json() or jws.deserialize() with empty signatures arrays.

Impact Analysis

Attackers can forge arbitrary content without a signing key, bypassing authentication and authorization checks. This may lead to authentication bypass, privilege escalation, forged authorization claims, or integrity bypass in microservices using Authlib for JWS verification.

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data or systems. Authentication bypass may lead to unauthorized data exposure or modification, violating integrity and confidentiality requirements.

Mitigation Strategies

Monitor the Authlib GitHub repository for patches and upgrade to the latest version once available. Avoid using JWS deserialization methods with empty signatures arrays. If immediate mitigation is needed, consider disabling JWS verification or switching to alternative libraries until a fix is released.

Hi! I’m here to help you understand CVE-2026-96760. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70