important · Edge — identity
An empty JWS signature array makes Authlib return attacker-controlled payloads as verified.
Affects
Authlib, a Python OAuth, OpenID Connect and JOSE library used by web applications and microservices.
Authlib initializes verification as successful and performs zero signature checks, so a consumer that trusts the result can accept forged identity, authorization, inter-service or configuration claims.
Detail and 2 sources
No vendor patch or downstream application inventory was available in the reviewed material.