Zero Radar
← feed
HighVulnerabilityCVE-2026-114616updated 27 Oct 2026, 16:09 UTC

Authlib accepts empty secret keys, letting attackers forge login tokens

If an app's signing secret is ever empty, anyone can create tokens that the app will accept as genuine. This can let attackers log in as other users or gain access they should not have.

Fixed in Authlib 1.9.1Official, 2 sources
SeverityHighCVSS 7.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesAuthlib 1.9.1 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts tokenChooses any claims they want
  2. 2Empty secret usedApp key lookup returns empty value
  3. 3Signature computedEmpty key makes signature public
  4. 4Authlib verifies tokenForged signature is accepted
  5. ResultAttacker is treated as authenticated

What happened

Authlib's HMAC (oct key) handling accepts a zero-length key for HS256/HS384/HS512 signing and verification, producing a deterministic signature that anyone can reproduce and forge.

Why it is dangerous: An attacker can craft arbitrary token claims that pass verification, enabling authentication bypass and impersonation in OAuth/OIDC servers and resource servers that rely on Authlib.

Are you affected?

You are affected if you use Authlib 1.7.2 or earlier and your application can verify HMAC-signed tokens with an empty key (e.g. a secret read from an unset environment variable, a config default of '', or a key lookup that returns '' on a miss).

Package / productAffected versionsFixed in
Authlib · pip< 1.9.11.9.1

What to do

  1. Update Authlib to version 1.9.1 or later
  2. Check that every JWT/HMAC signing and verification secret is set and non-empty, and fail startup if it is missing
  3. Review any token verification that relies on default or fallback secret values and remove them

Timeline

  1. 22 Oct 2026, 22:18 UTC
    Publicly disclosed
  2. 22 Oct 2026, 22:18 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 16:09 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 27 Oct 2026, 16:09 UTC
    Fixed version published: Authlib 1.9.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-114616 · GHSA-8m4g-j4wp-wgcg
CVSS
7.4 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 22:18 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 16:09 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Authlib accepts empty secret keys, letting attackers forge login tokens · Zero Radar