---
id: GHSA-6m87-8wg6-hh8w
title: >-
  Duplicate Advisory: Authlib: empty signatures validation in JWS JSON
  deserialization
summary: >-
  Duplicate Advisory: Authlib: empty signatures validation in JWS JSON
  deserialization
severity: critical
cvss: 9.8
cwe:
  - CWE-20
vendor: authlib
product: authlib
ecosystem: pip
affected:
  - authlib < 1.9.0
published: '2026-09-28'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:50:09Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-6m87-8wg6-hh8w'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96760'
  - url: 'https://github.com/authlib/authlib'
  - url: 'https://kb.cert.org/vuls/id/762428'
  - url: 'https://www.kb.cert.org/vuls/id/762428'
  - url: 'https://github.com/advisories/GHSA-6m87-8wg6-hh8w'
tags:
  - ghsa
  - pip
ingestedAt: '2026-10-27T16:11:58.746Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6v38-4h7w-rj9h. This link is maintained to preserve external references.

## Original Description
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

## Affected packages

- `authlib < 1.9.0`

## Remediation

Refer to the advisory for the patched release.