Authlib CVE-2026-96760 (GHSA-6v38-4h7w-rj9h): JsonWebSignature.deserialize_json() treats a JWS JSON object with an empty signatures list as verified, with no key. Am I affected and how do I fix it?

What it is: A critical signature-verification bypass in Authlib, the Python OAuth/OpenID/JOSE library, published 2026-10-27. When reading a JWS in JSON Serialization form, deserialize_json() started out assuming the token was valid and only marked it invalid while checking each signature. If the signatures list was empty, nothing was checked and the payload came back as verified, without any key. Anyone who can submit such a token to code that relies on deserialize_json() could make it accept forged claims. Am I affected: - Authlib 1.8.0 and earlier (fixed in 1.9.0). Check: pip show authlib. - The risky path is JWS JSON Serialization through JsonWebSignature.deserialize_json(), or a generic deserialize() that receives JSON-form input. Search your code and dependencies for deserialize_json and for places that accept JWS objects as JSON rather than the compact a.b.c form. Fix: 1. Upgrade to Authlib 1.9.0 or later: pip install -U "authlib>=1.9.0" (update lockfiles and rebuild images). 2. Until then, reject JWS JSON input whose signatures list is missing or empty before verifying, or accept only compact-serialized tokens if you don't need the JSON form. 3. Defense in depth: after verification, still check issuer, audience, expiry and algorithm against an allow-list. 4. If an exposed service used the vulnerable path, review logs for requests authenticated by JSON-form JWS and rotate any sessions or permissions granted from them. Verify: pip show authlib reports 1.9.0+, and a test that passes a JSON JWS with an empty signatures list now fails verification. Sources: https://github.com/authlib/authlib/security/advisories/GHSA-6v38-4h7w-rj9h https://github.com/authlib/authlib/releases/tag/v1.9.0 https://nvd.nist.gov/vuln/detail/CVE-2026-96760 https://kb.cert.org/vuls/id/762428