GHSA-7VR2-2FGP-9W7P Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

Summary OctKey.importkey carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is rawkey.startswithPOSSIBLEUNSAFEKEYS — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path...

Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

Summary OctKey.importkey carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is rawkey.startswithPOSSIBLEUNSAFEKEYS — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path...