Live › vulnerability › GHSA-6m87-8wg6-hh8w
Go to dashboardAuthlib's JsonWebSignature.deserialize_json() returns a payload as verified without checking any signature or requiring a key. An attacker can forge a token that the application treats as authentic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:52 UTC. All times on this page are UTC.
Applications that use Authlib to verify JWS objects in JSON serialization format on untrusted input are exposed. Projects that only use compact JWS or JWT verification with a fixed key, or that do not use Authlib's JWS JSON path, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| authlib | pypi | < 1.9.0 | – |
pip show authlib and compare it to the affected range below 1.9.0deserialize_json to see whether JWS JSON serialization is parsed from untrusted input1.9.0 or later, which the duplicate advisory points to via GHSA-6v38-4h7w-rj9hEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-6v38-4h7w-rj9h. This link is maintained to preserve external references.
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
This page as .md · .json · in your agent: get_signal("GHSA-6m87-8wg6-hh8w")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.