You. Had. One. Job.
https://nvd.nist.gov/vuln/detail/cve-2026-96760
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.
:rainbowCrow:
npub1z3…cp45m
2026-10-27 16:51:15 UTC
Author Public Key
npub1z3sfut2znnrtgl0qt4q6npq8zmjd9c97ck0gh0me44ua6lzaaajq6cp45mSeen on
wss://relay.ditto.pubPublished at
2026-10-27 16:51:15 UTCEvent JSON
{
"id": "c8303ed81aa83708e1fd4f36337c4bad39ad7826f5d142bad2333e22eb003cf8",
"pubkey": "14609e2d429cc6b47de05d41a9840716e4d2e0bec59e8bbf79ad79dd7c5def64",
"created_at": 1793119875,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/users/cR0w/statuses/117513904173194123",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "You. Had. One. Job.\n\nhttps://nvd.nist.gov/vuln/detail/cve-2026-96760\n\nAuthlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.",
"sig": "0f877720f7f7973b5b67dd6bc68938b216f7bc5d249802de3076f8a25b09879cacb3f3f1fb9dac95b46892738cf1039c0bc049350f5d789f904309b024afcf8d"
}