Authentication Bypass in Authlib Python Library

CVE-2026-114616

What is CVE-2026-114616?

The Authlib library, which is used to build OAuth and OpenID Connect servers, has a vulnerability where its key import method can accept zero-length key material. This could allow a remote attacker to exploit an application's secret lookup mechanism that returns an empty string or bytes, leading to the generation of valid HS256, HS384, or HS512 signatures for arbitrary token claims. As a result, an attacker can have the Authlib library incorrectly validate tokens, thereby compromising security. This issue has been addressed in version 1.9.1.

References