Incomplete List of Disallowed Inputs in authlib - CVE-2026-114615
Published: October 14, 2026 / Updated: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and disclose sensitive information.
The vulnerability exists due to incomplete rejection of asymmetric public keys in authlib.jose's OctKey.import_key() when importing PEM public keys or certificates with leading bytes before the armour header. A remote attacker can forge HS256 tokens with arbitrary claims using the issuer's public verification key as an HMAC secret to bypass authentication and disclose sensitive information.
Exploitation requires a relying party that uses the documented module-level jwt object with its mixed symmetric and asymmetric algorithm list. The leading bytes in the stored verification key are a deployment property and are not attacker-controlled at request time.