Authlib, a Python library used for OAuth, OpenID Connect, JWT/JWS/JWE implementations, has a vulnerability (CVE-2026-96760) in its JSON Web Signature handling. Specifically, the JsonWebSignature.deserialize_json() function incorrectly accepts JWS objects with an empty "signatures" array and treats the payload as successfully verified without any cryptographic validation. This flaw allows attackers to bypass signature verification entirely and supply forged content that the library treats as trusted. Both deserialize_json() and deserialize() methods are affected. The vulnerability impacts systems that rely on Authlib's JWS verification for authentication, authorization, inter-service message integrity, or signed configuration data. The vendor has not issued an official patch or statement, and users should monitor the GitHub repository for fixes.

An attacker can forge arbitrary authenticated payloads without any signing key or credentials. This can lead to authentication bypass, privilege escalation (e.g., forging identity claims such as sub=admin), injection of signed messages between microservices, forged authorization claims (scopes, roles, permissions), and integrity bypass in systems relying on signed JWS data. Systems trusting Authlib's JWS verification may accept malicious content as legitimate, potentially compromising security controls.

No official patch or fix is currently available from the vendor. Users should monitor the Authlib GitHub repository for updates and apply the latest version once a fix is released. Until then, consider implementing additional verification controls outside of Authlib's JWS handling or avoid using vulnerable versions for critical authentication or authorization functions.