Skip to main content

CISA details Authlib JWS verification bypass affecting versions up to 1.7.2

Source Decision Insights Threat Desk Published September 28, 2026 Companies 2
Human View Machine View

2 companies named across 2 categories, one of 78 articles referencing GitHub. Previous coverage: CISA issues alert on Kotaemon improper authorization checks (Sep 2026).

Companies mentioned

Best suited for

Seniority
Director
Job function
Cybersecurity / Information Security
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Buyer journey
Open to Buy
Adoption curve
Laggards
Technology maturity
Established Technology
Industry
Information Technology / Cybersecurity / Application, Cloud & AI Security / Application Security & DevSecOps (SAST/DAST/SCA/Supply Chain)

Our classification, not the publisher's statement. Best suited for, not only for.

Authlib versions up to and including 1.7.2 contain a signature-verification bypass in JSON Web Signature (JWS) general JSON serialization handling, allowing forged JWS content to be treated as successfully verified without key material, which can lead to authentication and integrity failures.

The issue is tracked as CVE-2026-96760. In Authlib, the JsonWebSignature.deserialize_json() function accepts a JWS object with an empty “signatures” array and treats the payload as successfully verified. The function takes the signatures as valid and performs no checks when the list is empty, so it accepts unsigned data as properly signed. The same condition affects two ways of loading a JWS: jws.deserialize_json({“payload”:“...”, “signatures”:[]}, key=None) and jws.deserialize('{“payload”:“...”,“signatures”:[]}', key=None).

An attacker can forge arbitrary authenticated payloads without any signing key or credentials. Systems that rely on Authlib’s JWS verification for authentication, authorization, inter-service message integrity, or signed configuration data may accept attacker-supplied content as legitimate.

No official patch was made available at the time of this writing, and the vendor could not be reached to coordinate the vulnerability. Users are advised to monitor the project’s GitHub repository and install the latest version of the library once a fix has been released.

Security testing efforts in this advisory are associated with Authlib’s JWS general JSON serialization handling, specifically the behavior of deserialize_json() when the “signatures” field is an empty list.

Blog post, originally published by Bob Kemerer at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-details-authlib-jws-verification-bypass-affecting-versions-up-to-1.7.2/",
        "name": "CISA details Authlib JWS verification bypass affecting versions up to 1.7.2",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-details-authlib-jws-verification-bypass-affecting-versions-up-to-1.7.2/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
      "name": "GitHub"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Director"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Laggards"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Cybersecurity / Application, Cloud & AI Security / Application Security & DevSecOps (SAST/DAST/SCA/Supply Chain)"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-09-28T15:21:06-06:00",
    "datePublished": "2026-09-28T15:21:02-06:00",
    "description": "Authlib versions up to 1.7.2 have a JWS signature verification bypass when “signatures” is empty, tracked as CVE-2026-96760.",
    "headline": "CISA details Authlib JWS verification bypass affecting versions up to 1.7.2",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Bob Kemerer"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/762428"
    },
    "keywords": [
      "Authentication",
      "Data",
      "JSON"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-details-authlib-jws-verification-bypass-affecting-versions-up-to-1.7.2/",
      "@type": "WebPage",
      "sdDatePublished": "2026-09-28",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
        "name": "GitHub"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages