Threats tagged 'ghsa-6v38-4h7w-rj9h'

Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty signatures array, which the method incorrectly accepts as valid without verifying any signature or requiring a cryptographic key. This leads to a complete authentication bypass where attacker-crafted payloads are accepted as legitimately signed.