CVE-2026-96760

What it actually does

The JsonWebSignature.deserialize_json() method in Authlib v1.7.2 and earlier accepts a JSON Serialization JWS object and returns the payload as successfully verified without performing any signature validation or requiring a cryptographic key, enabling complete bypass of signature-based authentication.

Why it matters to the business

Organizations using affected Red Hat Ansible Automation Platform Lightspeed components face risk of unauthorized access to sensitive automation and orchestration functions; while currently low exploit likelihood, the critical severity and presence in widely deployed enterprise products warrant prompt patching to avoid potential data exposure or system compromise.

How an attack unfolds

An attacker crafts a JSON-formatted JWS object containing a malicious or arbitrary payload, submits it to an endpoint relying on deserialize_json() for verification, and receives successful validation without any cryptographic check, allowing impersonation or injection of untrusted data into authenticated workflows.

How to fix it

Upgrade affected Red Hat products to the fixed versions: ansible-automation-platform-26/lightspeed updated via chatbot-rhel9:1791978798 (RHSA-2026:87120) and ansible-automation-platform-27/lightspeed updated via chatbot-rhel9:1791250620 (RHSA-2026:87120). Replace all instances of Authlib v1.7.2 and earlier with a patched release that enforces signature verification in deserialize_json().

How to confirm the fix worked

Confirm the installed Authlib version is newer than 1.7.2, test that deserialize_json() now rejects JWS objects lacking valid signatures, and verify application behavior rejects unsigned payloads with appropriate error handling.

Typical attack path

1. Identify an application or API endpoint that processes JWS tokens using Authlib's JsonWebSignature.deserialize_json()
2. Craft a JSON Serialization JWS object with attacker-controlled payload and no valid signature
3. Submit the malformed JWS via network request to the target endpoint
4. Receive successful verification response granting access to protected resources or functions
5. Escalate privileges or exfiltrate data using the bypassed authentication context

How to detect it

Review application logs for successful JWS deserialization events that lack corresponding signature validation errors or key usage indicators; examine network traffic for JSON-formatted JWS objects submitted to affected endpoints.

What your security team should do

• Apply the specified Red Hat Security Advisories (RHSA-2026:87120) immediately due to the critical CVSS rating
• Audit all code paths and dependencies that invoke JsonWebSignature.deserialize_json() for proper signature enforcement
• Monitor EPSS and threat intelligence feeds for any rise in exploit maturity over the next 30 days
• Implement compensating controls such as input validation or WAF rules to reject malformed JWS structures until patches are deployed