CVE-2026-96760
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
Risk Assessment
An attacker can forge JWS tokens that are accepted as valid, leading to authentication bypass and unauthorized access. This affects applications using Authlib for token verification.
Recommendation
Update Authlib to a version later than v1.7.2 that fixes this vulnerability. If updating is not possible, avoid using the deserialize_json() method for signature verification.
Other vulnerabilities in Authlib
See all- CVE-2026-27962Critical
A vulnerability in the Authlib library (versions prior to 1.6.9) allows an attacker to inject a JWK key into the JWT header. This enables forging arbitrary JWT tokens that pass signature verification, as the library uses the attacker-supplied key instead of a trusted server key.
- CVE-2026-28802Critical
Authlib versions 1.6.5 to 1.6.6 incorrectly passed malicious JWT tokens with 'alg: none' and an empty signature, bypassing signature verification. The issue is fixed in version 1.6.7.
- CVE-2026-28498High
A vulnerability was found in the Authlib library (versions before 1.6.9) in the validation of OpenID Connect ID Tokens. The _verify_hash function incorrectly accepts unsupported cryptographic algorithms by returning True instead of rejecting the token. This allows an attacker to bypass token integrity by providing a forged token with an unknown algorithm.
Original NVD description (English source)
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS