Key Forgery Vulnerability in Authlib Library Affects Token Security
CVE-2026-114615

7.4HIGH

Key Information:

Vendor

Authlib

Status
Authlib
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114615?

The Authlib library, used for building OAuth and OpenID Connect servers, contains a vulnerability where the OctKey.import_key() method only checks asymmetric-key markers at the start of the key. This flaw arises from the acceptance of leading whitespace, comments, or byte-order marks in PEM loaders, allowing an unauthenticated attacker with knowledge of public-key bytes to forge HS256 tokens. This bypasses previously established security measures, highlighting the necessity for version updates to mitigate associated risks.

Affected Version(s)

authlib >= 1.3.1, < 1.9.0

References

https://github.com/authlib/authlib/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/authlib/authlib/pull/945
x_refsource_MISC
https://github.com/authlib/authlib/commit/e3bd41cb29dcfee...
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.