CVE-2026-102946: CWE-290: Authentication Bypass by Spoofing in authlib joserfc

The authlib joserfc library versions before 1.7.4 contain an authentication bypass vulnerability (CWE-290) in the joserfc.jws.deserialize_json() function. When a JWS General JSON Serialization with an empty signatures array is processed, the verify_general_json() function performs no signature verification iterations and returns success by default. This allows an attacker to bypass signature verification and supply arbitrary payloads that relying applications may accept as authentic. This flaw is limited to the General JSON Serialization path and does not affect other JOSE serialization forms. The issue was resolved in version 1.7.4.

Successful exploitation allows an unauthenticated attacker to bypass signature verification and supply arbitrary payloads that applications may accept as authentic. This compromises the integrity and authenticity of data processed via the vulnerable General JSON Serialization path, potentially leading to unauthorized actions or data manipulation. The vulnerability does not affect other serialization paths such as compact JWS, JWT decoding, Flattened JSON serialization, or JWE JSON processing.

Upgrade to authlib joserfc version 1.7.4 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Applications relying on the General JSON Serialization path should ensure they are not using affected versions.