CVE-2026-114615

Name of the Vulnerable Software and Affected Versions Authlib versions 1.3.1 through 1.8.9

Description An issue exists in the OctKey.import key() function within authlib/jose/rfc7518/oct key.py where asymmetric-key markers are only checked at byte zero. Because PEM loaders accept leading whitespace, comments, or a byte-order mark, the POSSIBLE UNSAFE KEYS check fails to identify prefixed asymmetric key material. In deployments using a mixed algorithm registry configured with PEM or certificate bytes containing such prefixes, an unauthenticated attacker with knowledge of those public-key bytes can use them as an HMAC secret to forge HS256 tokens with arbitrary identity or authorization claims.

Recommendations Update to version 1.9.0.