Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Authlib, a Python library used to build OAuth and OpenID Connect servers, is affected. An attacker could forge signed JSON Web Tokens using HMAC algorithms (HS256, HS384, HS512) and have them accepted as genuine, but only in applications where the signing secret can be empty.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.
Affected versions
- authlib authlib
fixed in 1.9.1