Authlib versions prior to 0.23.1_2 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty signatures array, which is incorrectly accepted as valid without any cryptographic verification. As a result, attacker-crafted payloads can be accepted as authenticated, leading to a complete authentication bypass. The issue is fixed in version 0.23.1_2.