Inadequate Encryption Strength in authlib - #VU156092
Published: October 18, 2026
Vulnerability identifier: #VU156092
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-326
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to forge JWS/JWT tokens with arbitrary claims and bypass authentication.
The vulnerability exists due to acceptance of zero-length HMAC keys in Authlib's OctKey and HMACAlgorithm components when verifying JWS/JWT signatures using HS256, HS384, or HS512. A remote attacker can submit tokens signed with an empty key, whose signatures are publicly reproducible, to bypass signature verification in applications whose verification key resolves to an empty value.
Affected software
authlib
Remediation
Install security update from vendor's website.
authlib - update to 1.9.1