CVE-2026-96760

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Database specific

{
    "cna_assigner": "certcc",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96760.json"
}

References

Affected packages

Git / github.com/authlib/authlib

Affected ranges

Type

GIT

Repo

https://github.com/authlib/authlib

Events

Introduced

a0b76fac3fa114d7759af2010546bfc332364b63

Last Affected

a0b76fac3fa114d7759af2010546bfc332364b63

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.7.2"
                },
                {
                    "last_affected": "1.7.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandaloneSingleVersion"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "1.7.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

1.*

1.7.2

v1.*

v1.7.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-96760.json"