Authlib versions before 1.3.1 suffer from an algorithm confusion vulnerability involving asymmetric public keys. When decoding JWTs without specifying an algorithm, the library incorrectly allows HMAC verification using any asymmetric public key. This flaw can lead to improper verification of tokens, potentially enabling attackers to bypass authentication controls.