---
id: "CVE-2026-114616"
kind: "vulnerability"
aliases: ["CVE-2026-114616"]
title: "Authlib: empty HMAC key lets attackers forge accepted OAuth tokens"
severity: "high"
cvss: 7.4
epss: 0.00212
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authlib", "oauth", "openid-connect", "package", "python"]
not_affected_if: ["asymmetric-signing", "non-empty-static-secret"]
published_at: "2026-10-22T22:18:04+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:25:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114616", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114616", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Authlib: empty HMAC key lets attackers forge accepted OAuth tokens

Authlib's OctKey.import_key() and HMAC signing path accept zero-length keys. If an application's secret lookup returns an empty string or bytes, an attacker can compute valid HS256, HS384 or HS512 signatures for arbitrary claims and have the token accepted as authentic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Authlib version with `pip show authlib` and look for anything below `1.9.1`.
- Review the application's secret or key lookup code for paths that can return an empty string or empty bytes for HMAC keys.

## Fix

- Upgrade Authlib to `1.9.1` or later.
- Make the secret lookup fail closed so that empty key material is rejected.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114616
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114616

## From the sources

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_