CVE-2026-114616

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b	Patch
https://github.com/authlib/authlib/releases/tag/v1.9.1	Release Notes
https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*

History

29 Oct 2026, 14:51

Type	Values Removed	Values Added
References	~~() https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b -~~	() https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b - Patch
References	~~() https://github.com/authlib/authlib/releases/tag/v1.9.1 -~~	() https://github.com/authlib/authlib/releases/tag/v1.9.1 - Release Notes
References	~~() https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg -~~	() https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg - Exploit, Mitigation, Vendor Advisory
First Time		Authlib authlib Authlib
CPE		cpe:2.3:a:authlib:authlib::::::::

22 Oct 2026, 22:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-22 22:18

Updated : 2026-10-30 20:17

NVD link : CVE-2026-114616

Mitre link : CVE-2026-114616

CVE.ORG link : CVE-2026-114616

JSON object : View

Products Affected

authlib

authlib

CWE

CWE-287

Improper Authentication

CWE-326

Inadequate Encryption Strength

CWE-1391

Use of Weak Credentials

{"id": "CVE-2026-114616", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114616", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T20:07:25.381279Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "authlib", "product": "authlib", "versions": [{"status": "affected", "version": "< 1.9.1"}]}]}], "published": "2026-10-22T22:18:04.420", "references": [{"url": "https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/authlib/releases/tag/v1.9.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-326"}, {"lang": "en", "value": "CWE-1391"}]}], "descriptions": [{"lang": "en", "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1."}], "lastModified": "2026-10-30T20:17:00.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:authlib:authlib:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B8ABFEA-DEC5-4258-948D-BFD99A9997E0", "versionEndExcluding": "1.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}