CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability
Attackers can bypass signature verification in Authlib, accepting unsigned JWTs as valid, leading to potential authentication or authorization bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-96760?
CVE-2026-96760 is a critical vulnerability in Authlib, published on 28 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
Which versions are affected by CVE-2026-96760?
2 open source packages ship an affected version, including authlib.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | All versions | 1.9.0 |
authlib PyPI | All versions | 1.9.0 |
How do I fix CVE-2026-96760?
Upgrade authlib to 1.9.0 or later.
Is CVE-2026-96760 being exploited?
There is no known exploitation of CVE-2026-96760 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-96760, ECHO-c5ba-7fd7-ab22, GHSA-6v38-4h7w-rj9h, MINI-p48w-7ffj-27j5, UBUNTU-CVE-2026-96760.