Authlib: unsigned JWS JSON accepted as verified when the signatures array is empty (CVE-2026-96760)
Severity: critical · Patch status: patched · Since 2026-10-27 · CVE-2026-96760
In Authlib before 1.9.0, JsonWebSignature.deserializejson() reports success before it checks anything. An attacker can submit a JWS JSON object with an empty signatures array and get the payload back as verified, with no key used, even when the caller supplies the right key. Any service that trusts this call on attacker-supplied input will accept forged identity or authorisation claims, which makes it an unauthenticated authentication bypass. The advisory includes a reproduction on Authlib 1.8.0 and notes that joserfc rejects the same input. Fixed in Authlib 1.9.0 (PyPI upload 2026-10-14), which rejects empty signatures arrays. The advisory reports no in-the-wild exploitation.
What to do
- Upgrade authlib to 1.9.0 or later immediately
- Audit code for use of JsonWebSignature.deserialize_json() on untrusted input and treat any such path as bypassable until patched
- If upgrade is delayed, reject JWS JSON objects with empty or missing signatures arrays before passing to authlib, or switch to joserfc
- Review logs for tokens/requests with empty signatures arrays that may have been accepted
- Rotate or re-evaluate trust in any authorisation decisions made via JWS JSON verification on affected versions
Fixed versions
- authlib 1.9.0 (PyPI upload 2026-10-14)
Sources
All live incidents on Threat Watch
