Skip to content
Fencer Vulns
critical 9.8

CVE-2026-96760 json

Authlib library contains a signature‑verification bypass vulnerability

published 2026-09-28 41 d ago modified 2026-10-27 13 d ago also GHSA-6v38-4h7w-rj9h , EUVD-2026-88465

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

Patch / fix

  • pypi authlib 1.9.0
  • python-authlib Debian 14 1.9.1-1

debian advisories DEBIAN-CVE-2026-96760

  • python-Authlib openSUSE Tumbleweed 1.9.1-1.1

opensuse advisories openSUSE-SU-2026:12390-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-96760 updated cvss 7.5

authlib: authlib: Signature verification bypass via deserialize_json

  • Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9 Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-solution-server-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-agentic-sandbox-rhel9 Red Hat Enterprise Linux command line assistant rhel-cla/rhel-knowledge-bridge-rhel10 Red Hat OpenShift Virtualization 4 container-native-virtualization/ocp-virt-validation-checkup-rhel9, openshift-virtualization/konflux-builds/v4-22/ocp-virt-validation-checkup-rhel9
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-chatbot-rhel9 1791978798
    fixed: vendor fix RHSA-2026:87120
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/lightspeed-chatbot-rhel9 1791250620
    fixed: vendor fix RHSA-2026:79378
  • Red Hat Satellite 6.18 satellite/foreman-mcp-server-rhel9 1793272276
    fixed: vendor fix RHSA-2026:92667
  • Red Hat Satellite 6.19 satellite/foreman-mcp-server-rhel9 1793272279
    fixed: vendor fix RHSA-2026:92666
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1791947385, ansible-automation-platform-26/gateway-rhel9 1791971533, ansible-automation-platform-26/hub-web-rhel9 1791952205, ansible-automation-platform-26/receptor-rhel9 1791968536, ansible-automation-platform-26/mcp-tools-rhel9 1791941340, ansible-automation-platform-26/controller-rhel9 1791947602, +24 more Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/hub-rhel9 1791254555, ansible-automation-platform-27/gateway-rhel9 1791257377, ansible-automation-platform-27/hub-web-rhel9 1791264503, ansible-automation-platform-27/receptor-rhel9 1791251288, ansible-automation-platform-27/mcp-tools-rhel9 1790931895, ansible-automation-platform-27/controller-rhel9 1791253059, +26 more
    not affected: vulnerable code not present
  • Red Hat Hardened Images jaeger 2.20.0-0.11.hum1
    not affected: component not present
  • Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
39 d ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi authlib
<1.9.0
1.9.0

Affected products

  • Authlib Authlib

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature
  • CWE-670 Always-Incorrect Control Flow Implementation
  • CWE-358 Improperly Implemented Security Check for Standard
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.