Vulnerability · Published Sep 28, 2026 · Assigned by certcc
CVE-2026-96760Authlib library contains a signature‑verification bypass vulnerability
Critical 9.8
In plain English
A critical-severity improper input validation in Authlib from Authlib. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-authlib | no fix listed | DEBIAN-CVE-2026-96760 |
| Debian:13 | python-authlib | no fix listed | DEBIAN-CVE-2026-96760 |
| Debian:14 | python-authlib | 1.9.1-1 | DEBIAN-CVE-2026-96760 |
| PyPI | authlib | 1.9.0 | GHSA-6v38-4h7w-rj9h |
| Ubuntu:26.10 | python-authlib | no fix listed | UBUNTU-CVE-2026-96760 |
Affected products (as reported)
Weakness: CWE-347, CWE-670, CWE-358, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H