CVE-2026-114616

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114616
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-114616.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-114616
Aliases
Downstream
CGA (14)
CLEANSTART (1)
DEBIAN (1)
ECHO (1)
MINI (1)
openSUSE (1)
ROOT (1)
UBUNTU (1)
Related
Published
2026-10-22T21:14:03Z
Modified
2026-11-03T17:27:21Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
Details

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1391",
        "CWE-287",
        "CWE-326"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114616.json"
}
References

Affected packages

Git / github.com/authlib/authlib

Affected ranges

Type
GIT
Repo
https://github.com/authlib/authlib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
46b94870d915ee77430da8fa2a358378d90b3a45
Fixed
4ff30db442c70e29486e1982cb0ad37c037f5f4b
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.9.1"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "4ff30db442c70e29486e1982cb0ad37c037f5f4b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.9.1",
            "range": [
                {
                    "fixed": "46b94870d915ee77430da8fa2a358378d90b3a45"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.7.1
v0.*
v0.1
v0.10
v0.11
v0.12
v0.13
v0.14
v0.14.1
v0.14.2
v0.14.3
v0.15
v0.2
v0.2.1
v0.3
v0.4
v0.4.1
v0.5
v0.5.1
v0.6
v0.7
v0.8
v0.9
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v1.2.1
v1.3.0
v1.3.2
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-114616.json"