Live › vulnerability › CVE-2026-114615
Go to dashboardAuthlib's OctKey.import_key() only detects asymmetric key markers at byte zero, but its PEM loaders accept leading whitespace, comments, or a byte-order mark. An unauthenticated attacker who knows the public-key bytes a server uses for verification can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments that use the documented mixed algorithm registry and already verify tokens with PEM or certificate bytes containing a leading prefix are exposed, since the public key itself becomes a forgeable HMAC secret. Services that use Authlib only for other purposes, or that verify tokens with plain keys, are not in the described path.
No product ranges from the sources yet.
pip show authlib and confirm the installed version is between 1.3.1 and 1.9.0.1.9.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114615")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.