Threats tagged 'brew-omnara-cve-2026-96760'

Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty signatures array, which the method incorrectly accepts as valid without verifying any signature or requiring a cryptographic key. This results in an attacker-authored payload being accepted as authenticated, enabling a complete authentication bypass when identity or authorization claims are involved.