CVE-2026-96760: Authlib: empty signatures validation in JWS JSON deserialization
Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
References
- github.com/advisories/GHSA-6v38-4h7w-rj9h
- github.com/authlib/authlib/commit/6c11a02da8730914cea08ec195f1108a40dc6733
- github.com/authlib/authlib/pull/938
- github.com/authlib/authlib/releases/tag/v1.9.0
- github.com/authlib/authlib/security/advisories/GHSA-6v38-4h7w-rj9h
- kb.cert.org/vuls/id/762428
- nvd.nist.gov/vuln/detail/CVE-2026-96760
- www.kb.cert.org/vuls/id/762428
Code Behaviors & Features
Detect and mitigate CVE-2026-96760 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →