CVE-2026-114616

What it actually does

Authlib's OctKey.import_key() and HMAC signing/verification paths accept zero-length key material, enabling deterministic computation of valid HS256/HS384/HS512 signatures for arbitrary JWT claims when an application secret lookup returns an empty string or bytes.

Why it matters to the business

Attackers can forge authentication tokens to impersonate any user or bypass access controls, potentially exposing sensitive data, disrupting services, or allowing unauthorized actions in applications relying on Authlib for OAuth or OpenID Connect.

How an attack unfolds

An attacker identifies an application using Authlib where secret retrieval can return empty material, computes a valid HMAC signature for a crafted token containing desired claims using the empty key, and submits the token to protected endpoints where Authlib accepts it as authentic.

How to fix it

Upgrade Authlib to version 1.9.1 or later. Audit all secret lookup functions to ensure they never return empty strings or bytes, and add explicit validation rejecting zero-length keys before use in HMAC operations.

How to confirm the fix worked

Verify Authlib version is 1.9.1 or higher via package metadata or requirements files. Test token validation behavior with deliberately empty keys in a controlled environment and confirm rejection. Review application code for secret retrieval paths.

Typical attack path

1. Locate endpoints or flows protected by Authlib JWT validation
2. Determine or trigger a secret lookup path that returns empty key material
3. Craft a JWT with arbitrary claims and HS256/HS384/HS512 algorithm
4. Compute the deterministic signature using the empty key
5. Submit the forged token to bypass authentication

How to detect it

Inspect application logs for JWT validation events involving HS256/HS384/HS512 algorithms paired with empty key material indicators. Search for token acceptance events where secret retrieval returned zero-length values. Review any custom key import or secret provider code paths.

What your security team should do

• Immediately upgrade all Authlib installations to 1.9.1 or newer
• Scan codebases for secret lookup functions and enforce non-empty validation
• Monitor for JWT tokens using HS* algorithms during validation
• Review and test OAuth/OIDC flows for empty-key edge cases