GitHub Advisory Database11 days ago

Authlib: empty signatures validation in JWS JSON deserialization

Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a crypto

Published October 27, 2026 · 2:50 PM
Authlib (prior to 1.9.0) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a crypto
Read

Source: GitHub Advisory Database

Ask AI about this articleBeta

The AI only has access to this article — it won't make up facts. Try:

AI can be wrong. Cross-check before sharing.

Supporting evidence0 items
Community check0 comments
No votes yet
0% real0% fake