Catalogo CVE
CVE-2026-114616
python-authlib: CVE-2026-114616
- Gravità
- High · CVSS 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-authlib | sid | 1.7.2-2 | vulnerable |
| Debian | python-authlib | forky | 1.7.2-2 | vulnerable |
| Debian | python-authlib | trixie | 1.6.0-1+deb13u1 | vulnerable |
| Debian | python-authlib | bookworm | 1.2.0-1+deb12u1 | vulnerable |
| Debian | python-authlib | bookworm-security | 1.2.0-1+deb12u2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-authlib | source | sid | (unfixed) | not yet assigned | Not reported | [1151845] |
| Debian | python-authlib | source | forky | (unfixed) | not yet assigned | Not reported | [1151845] |
| Debian | python-authlib | source | trixie | (unfixed) | not yet assigned | Not reported | [1151845] |
| Debian | python-authlib | source | bookworm | (unfixed) | not yet assigned | Not reported | [1151845] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-authlib]Interessata
Pacchetto sorgente: [python-authlib]
Dettagli (4)
1.2.0-1+deb12u1· all · bookwormInteressata
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u1· all · bookwormInteressata
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u2· all · bookworm-securityInteressata
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u2· all · bookworm-securityInteressata
dsa · python-authlib · debian · bookworm
- [python-authlib-doc]Interessata
Pacchetto sorgente: [python-authlib]
Dettagli (4)
1.2.0-1+deb12u1· all · bookwormInteressata
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u1· all · bookwormInteressata
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u2· all · bookworm-securityInteressata
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u2· all · bookworm-securityInteressata
dsa · python-authlib · debian · bookworm
Osservato:
Riferimenti
- [https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b]
- [https://github.com/authlib/authlib/releases/tag/v1.9.1]
- [https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-114616]
- [https://security-tracker.debian.org/tracker/CVE-2026-114616]
[Debian Security Tracker] · [National Vulnerability Database (NVD)]