CVE-2021-44910_SpringBlade

CVE-2021-44910-SpringBlade Vulnerability Detection Tool SpringBlade JWT authentication vulnerability. Usage python3 Tested with HS256, HS384, and HS512 algorithms respectively...

Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)

Reporter: Cavan Loughran, Celvex Group Inc. Summary Authlib's symmetric oct key handling accepts an empty key empty bytes b'' / empty string '' as a valid HMAC signing and verification key. An empty HMAC key produces a deterministic digest that any party can reproduce, so an attacker who knows or...