Signature Verification Bypass in Authlib by Authlib
CVE-2026-96760
9.8CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-96760?
Authlib versions 1.7.2 and earlier have a vulnerability in the JsonWebSignature.deserialize_json() method, which improperly validates signatures. This flaw allows for the potential bypass of signature checks, as it accepts a JSON Serialization JWS object and returns the payload as verified, without requiring a cryptographic key. This presents a significant risk, enabling unauthorized access or manipulation of sensitive data.
Affected Version(s)
Authlib 1.7.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.