Authlib library contains a signature‑verification bypass vulnerability
Priority MEDIUM 49CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.
Summary
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00433 37th percentileScored 2026-11-07
Fix Partial authlib (PyPI): 1.9.0Red Hat: 4 advisoriesRed Hat: 4 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| authlib | Authlib | 1.7.2 | — | No fix listed | CNA |
| — | authlib (PyPI) | before 1.9.0 | 1.9.0 | Patch available | GHSA-6v38-4h7w-rj9h |
- Authlib Vendorauthlib Affected 1.7.2 Fixed in — No fix listed CNA
- authlib (PyPI) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-6v38-4h7w-rj9h
Remediation
- Fix · GHSA-6v38-4h7w-rj9h authlib (PyPI) Fixed in 1.9.0 Advisory →
Red Hat 4 advisories
- RHSA-2026:92667 Released 2026-10-29 · Red Hat rating Criticalsatellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
- RHSA-2026:92666 Released 2026-10-29 · Red Hat rating Criticalsatellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.19 registry.redhat.io/satellite/foreman-mcp-server-rhel9
- RHSA-2026:87120 Released 2026-10-21 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9 +8
Show 1 more Red Hat advisories
- RHSA-2026:79378 Released 2026-10-08 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/gateway-rhel9 +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Lightspeed Core | Affected | No fix yet |
| Migration Toolkit for Applications 8 | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| Red Hat Enterprise Linux command line assistant | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:87120 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:79378 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:92667 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:92666 |
Not affected: 4 products
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Hardened Images
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-96760
- 2026-10-03 Alias added: GHSA-6m87-8wg6-hh8w
- 2026-10-09 Fix available: RHSA-2026:79378 · Red Hat
- 2026-10-09 Fix available: Red Hat Ansible Automation Platform 2.7 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87120 · Red Hat
- 2026-10-22 Fix available: Red Hat Ansible Automation Platform 2.6 · Red Hat
- 2026-10-27 Alias added: GHSA-6v38-4h7w-rj9h
- 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92666 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92667 · Red Hat
References
Other 7
- https://github.com/authlib/authlib
- https://kb.cert.org/vuls/id/762428
- https://github.com/authlib/authlib/security/advisories/GHSA-6v38-4h7w-rj9h
- https://github.com/authlib/authlib/pull/938
- https://github.com/authlib/authlib/commit/6c11a02da8730914cea08ec195f1108a40dc6733
- https://github.com/authlib/authlib/releases/tag/v1.9.0
- https://www.kb.cert.org/vuls/id/762428
More authlib vulnerabilities
- TI-2026-65772 Insufficient verification of data authenticity in Authlib CVSS 3.1CRITICAL 9.8
- TI-2026-74876 Signature verification bypass in joserfc JWS deserialization CVSS 3.1CRITICAL 9.1
- TI-2026-22305 Authlib JWS JWK Header Injection: Signature Verification Bypass CVSS 3.1CRITICAL 9.1
- TI-2025-40202 Resource allocation without limits in authlib joserfc CVSS 4.0CRITICAL 9.2
- TI-2026-36756 joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) CVSS 4.0HIGH 8.7
- TI-2026-79518 Authlib fix bypass lets attackers forge HS256 tokens with PEM keys CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-96760 · CVE Program
- CVE-2026-96760 · NVD
- FIRST EPSS
- GHSA-6m87-8wg6-hh8w · GitHub Advisory Database · CC BY 4.0
- GHSA-6v38-4h7w-rj9h · GitHub Advisory Database · CC BY 4.0
- CVE-2026-96760 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences