Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This method incorrectly accepts JSON Serialization JWS objects with an empty signatures array as valid without verifying any signature or requiring a cryptographic key. This flaw allows an attacker to forge payloads that are accepted as authenticated by any relying party using this method on untrusted input.