Overview Authlib (versions up to and including 1.7.2) contain a signature‑verification bypass in the JSON Web Signature (JWS) general JSON serialization handling. The JsonWebSignature.deserialize_json() function accepts a JWS object with an empty "signatures" array and treats the payload as successfully verified, allowing attackers to supply arbitrary forged content without possessing any key material.
VU#762428: Authlib library contains a signature‑verification bypass vulnerability
About this summary. This is a short, independently written summary of an article first published by CERT/CC. Cyber Security News did not report or verify the underlying story. Read the original: https://kb.cert.org/vuls/id/762428
Source attribution: headline and facts are from CERT/CC (kb.cert.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
How we found 24 Android vulnerabilities using our open source AI security agent
With the rise of AI in the security space, our team created the GitHub Security Lab Taskflow Agent as a way for security researchers to easily automate, package, and…
Next.js applications, powered by Vite: introducing Vinext 1.0
When we launched Vinext in February, it was the result of an audacious week-long AI-driven experiment to see how far one engineer, and a stack of tokens, could get to…
Flatpak 1.18.4 fixes multiple security vulnerabilities
Posted by Simon McVittie on Sep 28 Flatpak 1.18.4 fixes several security vulnerabilties. All older releases should be assumed to be vulnerable. For more details please…
GitHub Engagement Signals for CVE Prioritization: The GitHub Popularity Metric (GPM)
arXiv:2609.31004v1 Announce Type: new Abstract: Attackers can compromise multiple systems with a single vulnerability, while defenders need to fix all security…
JevAdvBench: A Benchmark and Black-Box Attacks for Reinforcement Learning for Calibrated Decisions Models
arXiv:2609.31142v1 Announce Type: new Abstract: Models trained with reinforcement learning for calibrated decisions (RLCD), such as Jev, answer a typed question about an…
Infostealers Weekly Report: 2026-09-21 – 2026-09-28
InfoStealers Weekly Report – In this comprehensive report, we provide you with valuable insights into the most pressing threats facing organizations today. As…