VU#762428: Authlib library contains a signature‑verification bypass vulnerability
2026-09-28T20:52:01Z•9c121b77f29b14fc150ee9285549330d2e3d7ccc299fe14083a9abd0b6141316
CVE-2026-18311CVE-2026-18312CVE-2026-75907CVE-2026-82356CVE-2026-82987CVE-2026-82988CVE-2026-82989CVE-2026-86867CVE-2026-96760AndroidAuthlibCERT/CCImprivata EAMJWSKotaemonRFIDRSA-key-rotationReadwise ReaderSecure Boot bypassUEFIViewSonic vCastXSSaccess-controlarbitrary-code-executionauthentication-bypassbroken-access-controlcryptographic-failuredata-exposurefirmwarekey-cloningscreen-exfiltrationsupply-chainunauthenticated-access
What happened
CERT/CC advisories disclose multiple vulnerabilities across authentication libraries, mobile applications, smartboards, physical access systems, enterprise identity infrastructure, AI chat software, and UEFI Secure Boot. Issues include JWS signature-verification bypass, stored and reflected XSS, unauthenticated screen capture and arbitrary APK installation, RFID UID credential cloning, non-rotatable RSA keys, cross-user conversation access, and vendor-signed UEFI Shell Secure Boot bypass. Several vulnerabilities enable authentication bypass, sensitive-data exposure, unauthorized modification,,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 9c121b77f29b14fc150ee9285549330d2e3d7ccc299fe14083a9abd0b6141316
- Enrichment time
- 2026-09-28T20:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.