Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Vulnerability record

CVE-2026-96760

No known exploitation

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.

Description

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. Disclosed

    VU#762428: Authlib library contains a signature‑verification bypass vulnerability

    Basis: CERT/CC Vulnerability Notes (CERT advisory)

Coverage

References