Live › vulnerability › CVE-2026-114616
Go to dashboardAuthlib's OctKey.import_key() and HMAC signing path accept zero-length keys. If an application's secret lookup returns an empty string or bytes, an attacker can compute valid HS256, HS384 or HS512 signatures for arbitrary claims and have the token accepted as authentic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use Authlib to issue or verify HMAC-signed (HS256, HS384, HS512) tokens, where the key is fetched from a lookup that can return an empty value, such as a missing or unset configuration secret. Applications using asymmetric signing or fixed non-empty secrets are less exposed. Teams not using Authlib can skip it.
No product ranges from the sources yet.
pip show authlib and look for anything below 1.9.1.1.9.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114616")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.