CVE-2026-96760

CRITICAL 9.8

Authlib library contains a signature‑verification bypass vulnerability

CVSS Score

9.8

EPSS Score

0.4%

EPSS Percentile

38th

Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Vendor	authlib
Product	authlib
Published	Sep 28, 2026
Last Updated	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for authlib authlib

Be the first to know when new critical vulnerabilities affecting authlib authlib are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Authlib / Authlib

1.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/authlib/authlib kb.cert.org: https://kb.cert.org/vuls/id/762428 kb.cert.org: https://www.kb.cert.org/vuls/id/762428