{"id":"GHSA-6m87-8wg6-hh8w","summary":"Duplicate Advisory: Authlib: empty signatures validation in JWS JSON deserialization","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-6v38-4h7w-rj9h. This link is maintained to preserve external references.\n\n## Original Description\nAuthlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.","modified":"2026-10-27T15:00:05.441563351Z","published":"2026-09-28T21:31:18Z","withdrawn":"2026-10-27T14:50:09Z","database_specific":{"nvd_published_at":"2026-09-28T20:17:11Z","cwe_ids":["CWE-20"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-10-27T14:50:09Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96760"},{"type":"WEB","url":"https://github.com/authlib/authlib"},{"type":"WEB","url":"https://kb.cert.org/vuls/id/762428"},{"type":"WEB","url":"https://www.kb.cert.org/vuls/id/762428"}],"affected":[{"package":{"name":"authlib","ecosystem":"PyPI","purl":"pkg:pypi/authlib"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1","0.10","0.11","0.12","0.12.1","0.13","0.14","0.14.1","0.14.2","0.14.3","0.15","0.15.1","0.15.2","0.15.3","0.15.4","0.15.5","0.15.6","0.1rc0","0.2","0.2.1","0.3","0.4","0.4.1","0.5","0.5.1","0.6","0.7","0.8","0.9","1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0rc1","1.0.1","1.1.0","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.5.0","1.5.1","1.5.2","1.6.0","1.6.1","1.6.10","1.6.11","1.6.12","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0","1.9.1"],"database_specific":{"last_known_affected_version_range":"\u003c 1.9.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6m87-8wg6-hh8w/GHSA-6m87-8wg6-hh8w.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}