Threats tagged 'ghsa-6m87-8wg6-hh8w'

Authlib versions up to and including 1.7.2 contain a signature-verification bypass vulnerability in their JSON Web Signature (JWS) handling. The vulnerability allows attackers to supply JWS objects with an empty "signatures" array, which Authlib mistakenly treats as verified without performing signature checks. This enables attackers to forge arbitrary authenticated payloads without possessing any signing keys, potentially leading to authentication bypass, privilege escalation, and message integrity compromise. No official patch is currently available, and users should monitor the project's GitHub repository for updates.