Vulnerability PYSEC-2026-4356
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
8 days ago
October 22, 2026 at 10:18 PM UTC
No summary available
0.1rc0 - 1.9.0
0.1rc0 - 1.9.0
Details
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 hours ago
Authlib RFC 7592 examples omit registration-access-token client binding
0.15 - 1.9.0 GHSA-c73q-w75p-j82v
0.15 - 1.9.0 GHSA-c73q-w75p-j82v
High Risk
3 days ago
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
0.1rc0 - 1.9.0 GHSA-8m4g-j4wp-wgcg
0.1rc0 - 1.9.0 GHSA-8m4g-j4wp-wgcg
Medium Risk
3 days ago
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
1.6.0 - 1.8.0 GHSA-x4rv-c3wx-4cr8
1.6.0 - 1.8.0 GHSA-x4rv-c3wx-4cr8
Medium Risk
3 days ago
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
0.1rc0 - 1.8.0 GHSA-c5mf-xmp2-59rc
0.1rc0 - 1.8.0 GHSA-c5mf-xmp2-59rc
Medium Risk
3 days ago
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
0.1rc0 - 1.8.0 GHSA-fch4-3c6x-j4gc
0.1rc0 - 1.8.0 GHSA-fch4-3c6x-j4gc
Impacted packages
Timeline
Published
8 days ago
October 22, 2026 at 10:18 PM UTC
Fixed (1.9.1)
16 days ago
October 14, 2026 at 02:17 PM UTC
Last Modified
17 hours ago
October 30, 2026 at 10:00 AM UTC