You. Had. One. Job.
https://nvd.nist.gov/vuln/detail/cve-2026-96760
> Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
:rainbowCrow:
npub1s6…8n008
2026-10-27 16:51:15 UTC
Author Public Key
npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008Published at
2026-10-27 16:51:15 UTCEvent JSON
{
"id": "1c8e7e8083f08a88ddef96e70b33bc3dd012419116e996ac76cbbd6634d37359",
"pubkey": "86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac",
"created_at": 1793119875,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@cR0w/117513904173194123",
"web"
],
[
"proxy",
"https://infosec.exchange/users/cR0w/statuses/117513904173194123",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/cR0w/statuses/117513904173194123",
"pink.momostr"
],
[
"-"
]
],
"content": "You. Had. One. Job.\n\nhttps://nvd.nist.gov/vuln/detail/cve-2026-96760\n\n\u003e Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.",
"sig": "0bbb9a378ed0222959c41443d1c73e70d5cd05b473526869d0c1200a2140a1b9acc7c414a1cff376056f87917c59ba4bd451029115ed08a897cec4057cfd9d47"
}