Skip to content
Threat Feed
Subscribe

Product

Authlib (< 1.9.1)

1 brief RSS
critical advisory

Authlib: Signature verification bypass in JWS JSON deserialization

Authlib versions prior to 1.9.0 contain a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method returns the payload as successfully verified when provided with a JWS JSON Serialization object containing an empty signatures array, without checking for a signature or requiring a cryptographic key.

Authlib +1 authentication-bypass jws-vulnerability jwt crypto-vulnerability python
1t 2c