Cpe:2.3:a:authlib:authlib:*:*:*:*:*:python:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aauthlibauthlibpython/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 17:53:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthlib: Signature verification bypass in JWS JSON deserializationhttps://feed.craftedsignal.io/briefs/2026-10-authlib-jws-bypass/Tue, 27 Oct 2026 17:53:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-authlib-jws-bypass/Authlib versions prior to 1.9.0 contain a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method returns the payload as successfully verified when provided with a JWS JSON Serialization object containing an empty signatures array, without checking for a signature or requiring a cryptographic key.Authlib versions prior to 1.9.0 contain a vulnerability in the JsonWebSignature.deserialize_json() method. Due to an implementation error where a validation flag is initialized as True and never toggled if the signatures array is empty, the library treats payloads as verified without signature or key validation. This allows an unauthenticated caller to bypass authentication or authorization checks when processing forged JWS JSON objects.

]]>criticaladvisoryauthlibauthentication-bypassjws-vulnerabilityjwtcrypto-vulnerabilitypython