CVE-Katalog
CVE-2026-114616
python-authlib: CVE-2026-114616
- Schweregrad
- High · CVSS 7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Published
- Source
- [NVD] · [CVE record]
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-authlib | sid | 1.7.2-2 | vulnerable |
| Debian | python-authlib | forky | 1.7.2-2 | vulnerable |
| Debian | python-authlib | trixie | 1.6.0-1+deb13u1 | vulnerable |
| Debian | python-authlib | bookworm | 1.2.0-1+deb12u1 | vulnerable |
| Debian | python-authlib | bookworm-security | 1.2.0-1+deb12u2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-authlib | source | sid | (unfixed) | not yet assigned | Not reported | [1151845] |
| Debian | python-authlib | source | forky | (unfixed) | not yet assigned | Not reported | [1151845] |
| Debian | python-authlib | source | trixie | (unfixed) | not yet assigned | Not reported | [1151845] |
| Debian | python-authlib | source | bookworm | (unfixed) | not yet assigned | Not reported | [1151845] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-authlib]Betroffen
Quellpaket: [python-authlib]
Details (4)
1.2.0-1+deb12u1· all · bookwormBetroffen
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u1· all · bookwormBetroffen
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u2· all · bookworm-securityBetroffen
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u2· all · bookworm-securityBetroffen
dsa · python-authlib · debian · bookworm
- [python-authlib-doc]Betroffen
Quellpaket: [python-authlib]
Details (4)
1.2.0-1+deb12u1· all · bookwormBetroffen
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u1· all · bookwormBetroffen
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u2· all · bookworm-securityBetroffen
dsa · python-authlib · debian · bookworm
1.2.0-1+deb12u2· all · bookworm-securityBetroffen
dsa · python-authlib · debian · bookworm
Beobachtet:
Referenzen
- [https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b]
- [https://github.com/authlib/authlib/releases/tag/v1.9.1]
- [https://github.com/authlib/authlib/security/advisories/GHSA-8m4g-j4wp-wgcg]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-114616]
- [https://security-tracker.debian.org/tracker/CVE-2026-114616]
[Debian Security Tracker] · [National Vulnerability Database (NVD)]