CVE-2026-114615 Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

CVE-2026-114615 Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.importkey checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed...

CVE-2026-114615

The Python library Authlib (versions 1.3.1 to 1.9.0) is vulnerable to a security bypass where an unauthenticated attacker can forge HS256 tokens with arbitrary identity or authorization claims. The root cause lies in authlib/jose/rfc7518/oct_key.py, where OctKey.import_key() fails to correctly id...

CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +287 more potentially affected by CVE-2026-114614 via authlib (>=1.0.0b2, <=1.7.2)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-114614 Source advisory: MEND:CVE-2026-114614...

CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

CVE-2026-114614

The Authlib Python library (versions 0.13 through 1.8.0 ) is vulnerable due to a flaw in authlib.common.security.is_secure_transport() . The function uses a textual prefix comparison for loopback HTTP exemptions, which can be exploited if a URL's userinfo component begins with a loopback host whi...

OESA-2026-4500 python-oauthlib security update

AuthLib is a framework which implements the logic of OAuth1 or OAuth2 without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provide support onto your favourite web framework. If you're a maintainer of such a...

OESA-2026-4498 python-oauthlib security update

AuthLib is a framework which implements the logic of OAuth1 or OAuth2 without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provide support onto your favourite web framework. If you're a maintainer of such a...

OESA-2026-4499 python-oauthlib security update

AuthLib is a framework which implements the logic of OAuth1 or OAuth2 without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provide support onto your favourite web framework. If you're a maintainer of such a...

OESA-2026-4497 python-oauthlib security update

AuthLib is a framework which implements the logic of OAuth1 or OAuth2 without assuming a specific HTTP request object or web framework. Use it to graft OAuth client support onto your favorite HTTP library, or provide support onto your favourite web framework. If you're a maintainer of such a...

Authlib input validation error vulnerability

Versions of Authlib from 1.3.1 up to but not including 1.9.0 contain a security vulnerability. This vulnerability arises because OctKey.importkey checks for asymmetric key markers only at byte zero. However, PEM loaders accept leading whitespace, comments, or byte-order markers, which may allow...

PT-2026-121676

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description In the OpenIDImplicitGrant.validate authorization request function, the library checks the client-controlled raw request.payload.scope for the openid scope instead of using the filtered request.scope...

PT-2026-121662

Name of the Vulnerable Software and Affected Versions Authlib versions 1.3.1 through 1.8.9 Description An issue exists in the OctKey.import key function within authlib/jose/rfc7518/oct key.py where asymmetric-key markers are only checked at byte zero. Because PEM loaders accept leading whitespace...

PT-2026-121663

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.1 Description Authlib is a Python library used to build OAuth and OpenID Connect servers. The OctKey.import key function and the HMAC signing and verification path accept zero-length key material. If an...

PT-2026-121675

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description The default JWTBearerGrant.get audiences function returns an empty list, which leads JWTBearerGrant.verify claims to only check for the existence of an aud claim without verifying if it matches the...