Junglewise Threat Intelligence

CVE-2026-49852: authlib joserfc authentication bypass via empty HMAC key

CVE-2026-49852 · Severity: high · CVSS 4 · Published 2026-07-17

Technologies: Authlib Joserfc. Vendors: Authlib, PyPI.

Executive brief

joserfc is a Python library used to handle secure digital tokens (JWTs) for authentication and data exchange. A security flaw allows attackers to bypass authentication by creating forged tokens that the library incorrectly accepts as valid if the server's secret key is missing or empty (e.g., due to a configuration error or an unset environment variable). This could allow an unauthorized person to gain administrative access or impersonate other users on systems using this library.

Technical details

A vulnerability in joserfc's HMAC implementation (HS256/HS384/HS512) allows for signature bypass when the verification key is an empty string or None. The root cause is in `OctKey.import_key` and `HMACAlgorithm.verify`, where the library only issues a `SecurityWarning` for short keys but fails to reject zero-length keys. If an application sources its JWT secret from an unset environment variable or a missing configuration entry that defaults to an empty string, an attacker can generate a valid signature using an empty HMAC key. This allows for full authentication bypass and token forgery. The issue is fixed in version 1.6.8 by enforcing a hard rejection of empty keys.

Affected products

  • authlib joserfc < 1.6.8

Timeline

  • 2026-05-27: patched: Version 1.6.8 released
  • 2026-05-29: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: CVE published to NVD

References

Related threats