{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aauthlibauthlib/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*","cpe:2.3:a:authlib:authlib:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-96760"},{"cvss":7.4,"id":"CVE-2026-114616"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Authlib (prior to 1.9.0)","Authlib (\u003c 1.9.1)"],"_cs_severities":["critical"],"_cs_tags":["authlib","authentication-bypass","jws-vulnerability","jwt","crypto-vulnerability","python"],"_cs_type":"advisory","_cs_vendors":["Authlib"],"content_html":"\u003cp\u003eAuthlib versions prior to 1.9.0 contain a vulnerability in the \u003ccode\u003eJsonWebSignature.deserialize_json()\u003c/code\u003e method. Due to an implementation error where a validation flag is initialized as \u003ccode\u003eTrue\u003c/code\u003e and never toggled if the \u003ccode\u003esignatures\u003c/code\u003e array is empty, the library treats payloads as verified without signature or key validation. This allows an unauthenticated caller to bypass authentication or authorization checks when processing forged JWS JSON objects.\u003c/p\u003e\n","date_modified":"2026-10-27T17:54:36Z","date_published":"2026-10-27T17:53:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-authlib-jws-bypass/","summary":"Authlib versions prior to 1.9.0 contain a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method returns the payload as successfully verified when provided with a JWS JSON Serialization object containing an empty signatures array, without checking for a signature or requiring a cryptographic key.","title":"Authlib: Signature verification bypass in JWS JSON deserialization","url":"https://feed.craftedsignal.io/briefs/2026-10-authlib-jws-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}