CVE-2026-114616

Name	CVE-2026-114616
Description	Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-authlib (PTS)	bookworm	1.2.0-1+deb12u1	vulnerable
	bookworm (security)	1.2.0-1+deb12u2	vulnerable
	trixie	1.6.0-1+deb13u1	vulnerable
	forky, sid	1.7.2-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-authlib	source	(unstable)	(unfixed)

Notes

https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg
Fixed by: https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b (v1.9.1)