Vulnerability Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Authlib | Authlib | < 1.9.1 |
Related Weaknesses (CWE)
References
- https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5fPatch
- https://github.com/authlib/authlib/releases/tag/v1.9.1Release Notes
- https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcgExploitMitigationVendor Advisory
FAQ
What is CVE-2026-114616?
CVE-2026-114616 is a vulnerability with a CVSS score of 7.4 (HIGH). Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an a...
How severe is CVE-2026-114616?
CVE-2026-114616 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114616?
Check the references section above for vendor advisories and patch information. Affected products include: Authlib Authlib.