CyberRota Analysis
AI-GeneratedAuthlib versions 1.7.2 and earlier are vulnerable to a signature verification bypass, allowing the JsonWebSignature.deserialize_json() method to return payloads as verified without validating the signature or requiring a cryptographic key. This flaw could lead to unauthorized access or manipulation of data, making it critical for developers and organizations using Authlib to prioritize patching or upgrading to secure versions. Immediate action is recommended to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.