Authlib signature verification bypass in JWS JSON deserialization

Severity: critical · CVSS 9.8 · Published 2026-09-28

Authlib is a Python library for handling authentication protocols including JSON Web Signatures (JWS). A vulnerability in its JWS JSON deserialization method allows attackers to bypass signature verification entirely, accepting unsigned or tampered tokens as valid without requiring any cryptographic key. This could lead to authentication bypass, account takeover, or unauthorized access to protected resources in any application relying on Authlib for token validation.

Technologies: Authlib, authlib (PyPI). Vendors: Authlib, PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Critical severity, with a CVSS score of 9.8, published 28 September 2026.
Which products and versions are affected?
Authlib 1.7.2 and below; authlib (PyPI) < 1.9.0, ECOSYSTEM:introduced=0.
Is there a fix for This vulnerability?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The JsonWebSignature.deserialize_json() method fails to validate signatures on JWS objects in JSON serialization format, accepting payloads as verified even when signatures are absent or empty and without requiring a cryptographic key. The vulnerability affects Authlib v1.7.2 and below through improper input validation (CWE-20). This is a network-accessible bypass requiring no privileges or user interaction, giving attackers complete ability to forge authentication tokens.

Affected products

  • authlib authlib 1.7.2 and below

Timeline

  • 2026-09-28: disclosed
  • 2026-10-27: advisory: Advisory withdrawn as duplicate of GHSA-6v38-4h7w-rj9h

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.