Authlib versions up to and including 1.7.2 have a critical signature-verification bypass vulnerability in JWS general JSON serialization. The deserialize_json function incorrectly accepts JWS objects with an empty signatures array. This allows attackers to bypass signature verification entirely. Consequently, unsigned data is treated as if it were legitimately signed by the library. Attackers can exploit this by providing forged content without needing any key material. This flaw impacts both direct JSON deserialization and string deserialization methods. The primary impact is the ability for attackers to forge arbitrary authenticated payloads. This can lead to authentication bypass and privilege escalation by injecting forged identity claims. Microservices relying on JWS for message integrity are also vulnerable to injection attacks. Systems using JWS for authorization can be tricked into accepting forged scopes or roles. At present, no official patch is available as the vendor could not be reached. Users should monitor Authlib's GitHub repository for a fix and update accordingly.