Threats tagged 'brew-kimi-cli-cve-2026-96760'

Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty 'signatures' array, which the method incorrectly accepts as valid without verifying any signature or requiring a cryptographic key. This results in an authentication bypass where attacker-controlled payloads are accepted as legitimately signed. The issue arises because the validation flag is initialized to true and only set to false inside a loop that does not execute if the signatures array is empty. This vulnerability is fixed by rejecting empty signatures arrays or properly initializing the validation flag based on the presence of signatures.