RHLW-2026-7ee7f29bf79aac5c: Lightwell Security Advisory: authlib 1.9.0+rhlw.1
Red Hat Lightwell has released authlib 1.9.0+rhlw.1 with a backported security fix.
CVE-2026-114616: Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
This patched artifact is a drop-in replacement for authlib 1.9.0 from PyPI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/authlibto a version that resolves this vulnerability.Fixed in 1.9.0+rhlw.1 - Upgrade
Upgrade
authlibto a version that resolves this vulnerability.Fixed in 1.9.0+rhlw.1
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attacker must be able to submit or cause the application to accept a JWS or JWT signed with HMAC using HS256, HS384, or HS512. Exploitation relies on the application accepting an empty HMAC key.
What is the recommended remediation?
Replace authlib 1.9.0 from PyPI with Red Hat Lightwell authlib 1.9.0+rhlw.1. The advisory states that the patched artifact is a drop-in replacement.
Which cryptographic algorithms are implicated?
The issue affects HMAC-based JWS/JWT signature verification using HS256, HS384, and HS512. The provided data does not identify exposure for other algorithm families.