Ksanjeev284

Authlib is a Python library used to build OAuth and OpenID Connect servers. The `OctKey.import key()` function and the HMAC signing and verification path accept zero-length key material. If an application's secret lookup returns an empty string or empty bytes, a remote attacker can compute deterministic HS256, HS384, or HS512 signatures for arbitrary token claims, leading the library to treat the token as authentic.

The Agent dispatcher performs a JSON-based deep clone of constructor options before forwarding them to per-origin pools. Since JSON cannot represent functions, any `tls` option containing a `checkServerIdentity` callback is silently dropped. This allows a TLS peer to be accepted if it passes default hostname and chain checks, even if a custom `checkServerIdentity` was intended to reject it. This issue affects the default paths used by `request`, `fetch`, and `setGlobalDispatcher`, as well as the direct and no-proxy routes of `EnvHttpProxyAgent`. Only applications using function-valued `tls` options for tasks like certificate or public-key pinning are at risk.