CVE-2026-114615: Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.importkey() in authlib/jose/rfc7518/octkey.py, where POSSIBLEUNSAFEKEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Authlibto a version that resolves this vulnerability.Fixed in 1.9.0
Event History
Frequently Asked Questions
Which deployments are exposed to token forgery?
Exposure requires Authlib versions from 1.3.1 until 1.9.0, use of the documented mixed algorithm registry, and verification configured with PEM or certificate bytes that have leading whitespace, comments, or a byte-order mark. An attacker must also know the same public-key bytes.
Does an attacker need an account or user interaction to exploit this?
No. The issue is exploitable remotely without privileges or user interaction when the affected key and algorithm configuration is present.
What can an attacker do if exploitation succeeds?
An attacker can forge HS256 tokens using the prefixed public-key material as an HMAC secret. The forged tokens can contain arbitrary identity or authorization claims.
What should be done if upgrading is not immediately possible?
The provided data identifies the risky condition as a mixed algorithm registry combined with PEM or certificate verification bytes carrying a leading prefix. Removing that configuration condition can reduce exposure until upgrading to version 1.9.0.