CVE-2026-114616

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.1

Description Authlib is a Python library used to build OAuth and OpenID Connect servers. The OctKey.import key() function and the HMAC signing and verification path accept zero-length key material. If an application's secret lookup returns an empty string or empty bytes, a remote attacker can compute deterministic HS256, HS384, or HS512 signatures for arbitrary token claims, leading the library to treat the token as authentic.

Recommendations Update to version 1.9.1.