Authlib: empty signatures validation in JWS JSON deserialization
Not on CISA's list of exploited flaws, and not in the news we track.
0.43%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-96760. Nothing runs until you send it.
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
You are affected if
The fix