CVE-2026-96760 — Authlib library contains a signature‑verification bypass vulnerability

CVE-2026-96760

Authlib library contains a signature‑verification bypass vulnerability PUBLISHED

Description (CNA)

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Affected (CNA)

Vendor / product	Versions
Authlib / Authlib	affected 1.7.2

CWE

No CWE identifiers supplied.

References

https://github.com/authlib/authlib
https://kb.cert.org/vuls/id/762428

ADP enrichment

CVE

No English description supplied.

https://www.kb.cert.org/vuls/id/762428

CISA-ADP

No English description supplied.

No references supplied.