CVE-2026-96760CWE-20CWE-347CWE-358CWE-670

CVE-2026-96760

Critical · published September 29, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-347 · Improper Verification of Cryptographic Signature; CWE-358 · Improperly Implemented Security Check for Standard; CWE-670 · Always-Incorrect Control Flow Implementation
Published
2026-09-29T00:17Z
References (3)
https://github.com/authlib/authlib · [email protected]https://kb.cert.org/vuls/id/762428 · [email protected]https://www.kb.cert.org/vuls/id/762428 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 30 SEP 03:29Z
    EPSS moved — → 0%
    epss
  • 28 SEP 19:37Z
    Authlib library contains a signature‑verification bypass vulnerability
    cvelistv5