CVE-2026-114615 Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114615?
CVE-2026-114615 is a high-severity vulnerability in authlib, published on 22 Oct 2026.
Official description
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.
Which versions are affected by CVE-2026-114615?
2 open source packages ship an affected version, including authlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
authlib PyPI | From 1.3.1 | 1.9.0 |
authlib PyPI | From 1.3.1 | 1.9.0 |
Products include Authlib Authlib.
How do I fix CVE-2026-114615?
Upgrade authlib to 1.9.0 or later.
Is CVE-2026-114615 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-114615 exists.
Other vulnerabilities in authlib
- CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass
- CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
- CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding
- CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification
- CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Sources
Also known as DEBIAN-CVE-2026-114615, ECHO-47bf-b555-f683, GHSA-7vr2-2fgp-9w7p, MINI-fcx9-3vf9-f9qm, UBUNTU-CVE-2026-114615.