Threats Tagged 'cve-2026-96760'

Red Hat has issued a critical security advisory for Red Hat Ansible Automation Platform 2.7 Container Release. This update addresses multiple security vulnerabilities affecting the platform, which provides an enterprise framework for IT automation. The advisory includes fixes for several CVEs and related bugs. Users are advised to apply the update after ensuring all previous errata are applied. No specific affected versions are detailed in the advisory.

Authlib versions up to and including 1.7.2 contain a signature-verification bypass vulnerability in their JSON Web Signature (JWS) handling. The vulnerability arises because the deserialize_json() function accepts JWS objects with an empty "signatures" array and treats the payload as verified without performing any signature checks. This allows attackers to forge arbitrary authenticated payloads without possessing any signing keys. Systems relying on Authlib for authentication, authorization, or message integrity may accept attacker-supplied content as legitimate. No official patch is currently available, and users are advised to monitor the project's GitHub repository for updates.