Authlib: Signature verification bypass in JWS JSON deserialization
Authlib versions prior to 1.9.0 contain a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method returns the payload as successfully verified when provided with a JWS JSON Serialization object containing an empty signatures array, without checking for a signature or requiring a cryptographic key.
CVE search metadata
CVE search record: CVE-2026-96760. Severity: critical. CVSS: 9.8. EPSS: 0.38%. KEV: no. Product: Authlib (prior to 1.9.0), Authlib (< 1.9.1). Brief: Authlib: Signature verification bypass in JWS JSON deserialization. Brief link: https://feed.craftedsignal.io/briefs/2026-10-authlib-jws-bypass/
CVE search record: CVE-2026-114616. Severity: high. CVSS: 7.4. EPSS: 0.21%. KEV: no. Product: Authlib (prior to 1.9.0), Authlib (< 1.9.1). Brief: Authlib: Signature verification bypass in JWS JSON deserialization. Brief link: https://feed.craftedsignal.io/briefs/2026-10-authlib-jws-bypass/
Triage facts
Revision 1- Applicability
- Authlib (prior to 1.9.0), Authlib (< 1.9.1)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 27, 17:53 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Very likely
What's new
- 1. added coverage for Authlib (< 1.9.1) Oct 27, 17:54 via ghsa
Authlib versions prior to 1.9.0 contain a vulnerability in the JsonWebSignature.deserialize_json() method. Due to an implementation error where a validation flag is initialized as True and never toggled if the signatures array is empty, the library treats payloads as verified without signature or key validation. This allows an unauthenticated caller to bypass authentication or authorization checks when processing forged JWS JSON objects.
Immediate actions
Upgrade Authlib dependencies to 1.9.1 or later
Threat Hunt
Identify applications using Authlib for JWT verification that source secret keys from environment variables or configuration files prone to defaulting to empty values.
Data: Application dependency manifests (requirements.txt, pyproject.toml), Code review of JWT secret retrieval logic
Mitigations
Implement explicit length validation for all HMAC keys used with Authlib.
CVE-2026-114616