CVE-2026-114616: Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.importkey() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Authlibto a version that resolves this vulnerability.Fixed in 1.9.1
Event History
Frequently Asked Questions
Which deployments are actually exposed?
Deployments using Authlib before 1.9.1 are exposed if their application’s secret lookup can return an empty string or empty bytes for an HMAC-signed JWS or JWT. The affected algorithms are HS256, HS384, and HS512.
What does an attacker need to exploit this issue?
An attacker needs the application to accept a token whose HMAC key resolves to zero-length key material. No credentials or user interaction are required, and the attacker can create a valid deterministic signature over arbitrary token claims.
Are applications using asymmetric JWT signing affected?
The provided information identifies the vulnerable signing and verification path as HMAC-based HS256, HS384, and HS512. It does not identify asymmetric signing algorithms as affected.
What should be done if an immediate upgrade is not possible?
Ensure secret lookup cannot return an empty string or empty bytes for any HMAC JWS/JWT key, and reject tokens when key material is missing or empty. Upgrade Authlib to version 1.9.1 when possible.