Source: python-authlib Version: 1.7.2-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream Forwarded: https://github.com/authlib/authlib/issues/940
Hi, The following vulnerability was published for python-authlib. CVE-2026-96760[0]: | Authlib (v1.7.2 and below) contains a signature verification bypass | vulnerability. The JsonWebSignature.deserialize_json() method | accepts a JSON Serialization JWS object and returns the payload as | successfully verified without checking for a signature and without | requiring a cryptographic key. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-96760 https://www.cve.org/CVERecord?id=CVE-2026-96760 [1] https://kb.cert.org/vuls/id/762428 [2] https://github.com/authlib/authlib/issues/940 Please adjust the affected versions in the BTS as needed.
