CVE-2026-114616 Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

What is CVE-2026-114616?

CVE-2026-114616 is a high-severity vulnerability in authlib, published on 22 Oct 2026.

Official description

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.

Weakness: CWE-326, CWE-287, CWE-1391

Which versions are affected by CVE-2026-114616?

2 open source packages ship an affected version, including Authlib and authlib. It affects 1 product.

Products include Authlib Authlib.

How do I fix CVE-2026-114616?

Upgrade Authlib to 1.9.1 or later.

Is CVE-2026-114616 being exploited?

There is no known exploitation of CVE-2026-114616 in the wild and no public exploit code.

Other vulnerabilities in authlib

• CVE-2026-27962 Authlib JWS JWK Header Injection: Signature Verification Bypass Critical 9.1
• CVE-2026-28490 Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle High 8.3
• CVE-2026-28498 Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding High 8.2
• CVE-2026-28802 Authlib: Setting `alg: none` and a blank signature appears to bypass signature verification High 7.7
• CVE-2025-61920 Authlib is vulnerable to Denial of Service via Oversized JOSE Segments High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-114616, ECHO-9a12-6f46-0481, GHSA-8m4g-j4wp-wgcg, MINI-vfp6-7m3r-grpf, UBUNTU-CVE-2026-114616.