Is CVE-2026-114616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114616 being exploited in the wild.

How severe is CVE-2026-114616?

High severity, with a CVSS score of 7.4, published 22 October 2026.

Which products and versions are affected?

Authlib before 1.9.1; authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.9.1; Authlib < 1.9.1.

Is there a fix for CVE-2026-114616?

Yes. authlib (PyPI): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114616 attacked?

It is attacked over the network.

Am I affected by CVE-2026-114616?

Check whether you run Authlib, authlib (PyPI) or Authlib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114616: Authlib HMAC signature forgery with zero-length keys

Q: Is there a fix for CVE-2026-114616?

Yes. authlib (PyPI): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114616 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-114616?

Check whether you run Authlib, authlib (PyPI) or Authlib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114616 · Severity: high · CVSS 7.4 · Published 2026-10-22

Authlib is a Python library for building OAuth and OpenID Connect servers. If an application's secret lookup returns an empty string or empty bytes, attackers can forge valid HS256, HS384, or HS512 signatures for any token claims without knowing the secret, allowing them to impersonate any user or obtain unauthorized access to protected resources.

Technologies: Authlib, authlib (PyPI). Vendors: Authlib, PyPI.

Quick answers

Is CVE-2026-114616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114616 being exploited in the wild.
How severe is CVE-2026-114616?: High severity, with a CVSS score of 7.4, published 22 October 2026.
Which products and versions are affected?: Authlib before 1.9.1; authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.9.1; Authlib < 1.9.1.
Is there a fix for CVE-2026-114616?: Yes. authlib (PyPI): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114616 attacked?: It is attacked over the network.
Am I affected by CVE-2026-114616?: Check whether you run Authlib, authlib (PyPI) or Authlib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

authlib (PyPI): upgrade to 1.9.1 or later
```
pip install "authlib>=1.9.1"
```

Technical details

Authlib's OctKey.import_key() and HMAC signing/verification functions accept zero-length key material, violating HMAC security requirements. An attacker who can cause a secret lookup to return empty bytes can compute deterministic signatures for arbitrary JWT claims that will pass verification, gaining unauthorized access. This requires the application to be configured to return empty secrets, but is a serious issue once triggered.

Affected products

Authlib Authlib before 1.9.1

Identifiers

CVE-2026-114616
GHSA-8m4g-j4wp-wgcg
PYSEC-2026-4356

Timeline

2026-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.