Technical impact
Authlib versions 1.7.2 and earlier expose a flaw where the JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and treats it as successfully verified without checking the signature or requiring a cryptographic key. This omission allows an attacker to supply a crafted JWS payload that the library will accept, effectively bypassing authentication and enabling the execution of arbitrary data. The flaw corresponds to improper input validation (CWE‑20), incorrect handling of cryptographic signatures (CWE‑358), and failure to enforce necessary authorization checks (CWE‑670).
Affected Systems
The vulnerability exists in the Authlib Python library, affecting all releases up to and including version 1.7.2. Systems that import and use Authlib for JSON Web Signature processing, particularly in web frameworks or authentication services, are impacted. Projects that depend on older Authlib without applying a subsequent patch or override of the deserialize_json method are susceptible.
Risk and Exploitability
With a CVSS score of 9.8 and an EPSS score of less than 1%, the vulnerability is classified as critical severity, although the likelihood of exploitation remains uncertain. Because it is not listed in the CISA KEV catalog, the exact exploitation landscape is not fully documented. The flaw bypasses cryptographic checks entirely, so any context where Authlib validates incoming JWS tokens—such as APIs, web services, or identity frameworks—remains vulnerable until the library is upgraded or patched. Attackers can inject malicious content and have it treated as authentic, potentially leading to privilege escalation or unauthorized access. Because the method does not enforce signature validation, any user interaction that passes via JWS to the application poses a risk.
Github GHSA