CVE-2026-114616

A flaw was found in Authlib. The library improperly accepts zero-length key material during Hash-based Message Authentication Code HMAC signing and verification. If a host application verifies tokens using a secret that evaluates to an empty value, a remote attacker can generate predictable...