CVE-2026-96760: authlib Improper Input Validation
CVSS: 9.8v3.1CriticalAwaiting analysis
AliasesUBUNTU-CVE-2026-96760DEBIAN-CVE-2026-96760
Published 28-09-2026Last modified 01-10-2026
Vulnerability summary
CVE-2026-96760 is a critical (CVSS 9.8) Improper Input Validation vulnerability in authlib. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
0.28%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 28-09-2026PublishedVulnerability first disclosed.
- 01-10-2026Last modifiedVulnerability information updated.
Description
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
CVSS metrics
4 scores · 4 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
29-09-202620-10-2026
EPSS score0.28%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
- CWE-358Improperly Implemented Security Check for StandardThe product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
- CWE-670Always-Incorrect Control Flow ImplementationThe code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Affected systems
Authlib1 product
- authlib1.7.2
Debian1 product
- python-authlibAll versions (No fix recorded)
Ubuntu1 product
- python-authlibAll versions (No fix recorded)
3 vendors · 3 products
