Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Tag

#Authlib

1 articles

Deep Dive

Authlib JWS Signature Bypass, Fixed in 1.9.0 (CVE-2026-96760)

Authlib up to 1.8.0 treats a JWS JSON object with empty signatures as verified without checking the key: Critical CVE-2026-96760 (CVSS 9.1), fixed in 1.9.0.

Ostorlab Team
Oct 27, 2026