CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-114615 — Authlib is a Python library which builds OAuth and OpenID Connect servers. From ...

·Source: NIST NVD

Updated:

Executive Summary

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a

Analysis

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0. CVSS Score: 7.4. Published: 2026-10-22T22:18:04.257.

Indicators of Compromise (2)

CVE (2)
CVE-2024-37568
NVDMITRE CVE
CVE-2026-114615
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 22, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Student SSNs and Medicaid IDs Exposed in Frontline School Software Breach

Kalleigh Lane reports: If your school district used Frontline Central or School Health Management, your Social Security number, date of birth, or government ID could have been caught up in a cybersecurity incident. That risk applies to some adults and minors whose information was processed through those products. Frontline Education announced Oct. 26, 2026, that...

DataBreaches.net
MEDIUMVulnerabilityNEW

GM settles with 36 states for selling driver data, agrees to $220 million fine and reforms

General Motors agreed to pay $220 million to settle a lawsuit filed by a coalition of 36 state attorneys general who alleged the company unlawfully sold information about driver behavior to outside parties.

The Record
MEDIUMVulnerability

Fake crypto app on Apple App Store linked to $23K wallet theft

A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. [...]

BleepingComputer