Critical severity9.8NVD Advisory· Published Sep 28, 2026· Updated Nov 11, 2026
CVE-2026-96760
CVE-2026-96760
Description
Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
authlibPyPI | < 1.9.0 | 1.9.0 |
Affected products
1Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-6v38-4h7w-rj9hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-96760ghsaADVISORY
- github.com/authlib/authlib/commit/6c11a02da8730914cea08ec195f1108a40dc6733ghsaWEB
- github.com/authlib/authlib/pull/938ghsaWEB
- github.com/authlib/authlib/releases/tag/v1.9.0ghsaWEB
- github.com/authlib/authlib/security/advisories/GHSA-6v38-4h7w-rj9hghsaWEB
- kb.cert.org/vuls/id/762428nvdWEB
- www.kb.cert.org/vuls/id/762428nvdWEB
News mentions
1- ⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsThe Hacker News · Oct 5, 2026