Attributed metadata history
Up to 100 retained publisher events per page for 80c2381afbbb2e8096fbd5152494c3d8f20a53ed4f43150fa0c9d09a588df26a. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
available
Fingerprint: e9e546feaa1a197f9c3a53bee19e29f6899cd295cb68e67b1de5b309ac3481e8
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
Overview Authlib (versions up to and including 1.7.2) contain a signature‑verification bypass in the JSON Web Signature (JWS) general JSON serialization handling. The JsonWebSignature.deserialize_json() function accepts a JWS object with an empty "signatures" array and treats the payload as successfully verified, allowing attackers to supply arbitrary forged content without possessing any key material. Description Authlib is a Python library that provides tools for implementing OAuth, OpenID Connect, JWT/JWS/JWE (JSON Web Token / JSON Web Signature / JSON Web Encryption), and other modern authentication and authorization standards. It’s widely used in web applications and microservices to handle token creation, cryptographic validation, and secure communication. As discussed in CVE-2026-96760, a security flaw in Authlib’s handling of JSON Web Signatures (JWS) makes it possible for an attacker to skip signature verification completely. Normally, a JWS should include at least one valid signature to prove the data hasn’t been tampered with. However, Authlib’s deserialize_json() function mistakenly accepts JWS objects even when the "signatures" section is an empty list. Beca
Fingerprint: 00b82cc58b34d0738390e70f1f8c8735e4b15af841e79824cd62bd1f2b4d10af