CVE-2026-114616High· 7.4▾ TwilightAuthlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
authlib < 1.9.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114618Medium· 6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audience
CVE-2026-45363Critical· 9.1ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard
CVE-2026-114620Medium· 5.4Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
CVE-2026-114619Medium· 4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-114617Medium· 4.2Authlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys