GHSA-6m87-8wg6-hh8w
Suggest an improvement- Source
- https://github.com/advisories/GHSA-6m87-8wg6-hh8w
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6m87-8wg6-hh8w/GHSA-6m87-8wg6-hh8w.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-6m87-8wg6-hh8w
- Downstream
- Withdrawn
- 2026-10-27T14:50:09Z
- Published
- 2026-09-28T21:31:18Z
- Modified
- 2026-10-27T15:00:05Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Duplicate Advisory: Authlib: empty signatures validation in JWS JSON deserialization
- Details
-
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-6v38-4h7w-rj9h. This link is maintained to preserve external references.
Original Description
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
- Database specific
{ "cwe_ids": [ "CWE-20" ], "github_reviewed": true, "github_reviewed_at": "2026-10-27T14:50:09Z", "nvd_published_at": "2026-09-28T20:17:11Z", "severity": "CRITICAL" }- References
Affected packages
PyPI / authlib
Package
- Name
- authlib
- View open source insights on deps.dev
- Purl
- pkg:pypi/authlib
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
0.*
0.1rc0
0.1
0.2
0.2.1
0.3
0.4
0.4.1
0.5
0.5.1
0.6
0.7
0.8
0.9
0.10
0.11
0.12
0.12.1
0.13
0.14
0.14.1
0.14.2
0.14.3
0.15
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
1.*
1.0.0a1
1.0.0a2
1.0.0b1
1.0.0b2
1.0.0rc1
1.0.0
1.0.1
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.5.0
1.5.1
1.5.2
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.6.10
1.6.11
1.6.12
1.7.0
1.7.1
1.7.2
1.8.0
1.9.0
1.9.1