CVE-2026-96760
No fix known EPSS <1%CVSS 9.8
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
Products: authlib
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | python-authlib | no fix |
| Debian 13 | python-authlib | no fix |
| Debian 14 | python-authlib | no fix |
| Ubuntu 26.10 | python-authlib | no fix |
| Ubuntu Pro 22.04 LTS | python-authlib | no fix |
| Ubuntu Pro 24.04 LTS | python-authlib | no fix |
| Ubuntu Pro 26.04 LTS | python-authlib | no fix |