# CVE-2026-49852: authlib joserfc authentication bypass via empty HMAC key

Source: https://junglewise.ai/threats/cve-2026-49852-authlib-joserfc-authentication-bypass-via-empty-hmac-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-49852 · Severity: high · CVSS 4 · Published 2026-07-17

joserfc is a Python library used to handle secure digital tokens (JWTs) for authentication and data exchange. A security flaw allows attackers to bypass authentication by creating forged tokens that the library incorrectly accepts as valid if the server's secret key is missing or empty (e.g., due to a configuration error or an unset environment variable). This could allow an unauthorized person to gain administrative access or impersonate other users on systems using this library.

Technologies: [Authlib Joserfc](https://junglewise.ai/threats/technologies/joserfc), [joserfc (PyPI)](https://junglewise.ai/threats/technologies/pypi-joserfc). Vendors: [Authlib](https://junglewise.ai/threats/vendors/authlib), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-49852 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49852 being exploited in the wild.

**How severe is CVE-2026-49852?** High severity, with a CVSS score of 4, published 17 July 2026.

**Which products and versions are affected?** Authlib Joserfc < 1.6.8, <= 1.6.7; joserfc (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.8.

**Is there a fix for CVE-2026-49852?** Yes. joserfc (PyPI): upgrade to 1.6.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49852 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49852?** Check whether you run Authlib Joserfc or joserfc (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- joserfc (PyPI): upgrade to 1.6.8 or later

  ```sh
  pip install "joserfc>=1.6.8"
  ```


## Technical details

A vulnerability in joserfc's HMAC implementation (HS256/HS384/HS512) allows for signature bypass when the verification key is an empty string or None. The root cause is in `OctKey.import_key` and `HMACAlgorithm.verify`, where the library only issues a `SecurityWarning` for short keys but fails to reject zero-length keys. If an application sources its JWT secret from an unset environment variable or a missing configuration entry that defaults to an empty string, an attacker can generate a valid signature using an empty HMAC key. This allows for full authentication bypass and token forgery. The issue is fixed in version 1.6.8 by enforcing a hard rejection of empty keys.

## Affected products

- authlib joserfc < 1.6.8

## Identifiers

- CVE-2026-49852
- GHSA-gg9x-qcx2-xmrh
- PYSEC-2026-2528

## Timeline

- 2026-05-27: patched: Version 1.6.8 released
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD

## References

- [https://github.com/authlib/joserfc/commit/86d00910b2b2d2d07503fee9b572906daefab7f1](https://github.com/authlib/joserfc/commit/86d00910b2b2d2d07503fee9b572906daefab7f1)
- [https://github.com/authlib/joserfc/releases/tag/1.6.8](https://github.com/authlib/joserfc/releases/tag/1.6.8)
- [https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh](https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh)

## Related threats

- [joserfc memory exhaustion in compact JWS deserialization](https://junglewise.ai/threats/cve-2026-119284-joserfc-is-a-python-library-that-provides-an-implementation-of)
- [joserfc JWE denial of service via unlimited recipients](https://junglewise.ai/threats/cve-2026-119283-joserfc-is-a-python-library-that-provides-an-implementation-of)
- [authlib joserfc issuer validation bypass in JWT claims](https://junglewise.ai/threats/cve-2026-75509-authlib-joserfc-issuer-validation-bypass-in-jwt-claims)
- [authlib joserfc token malleability via trailing padding](https://junglewise.ai/threats/cve-2026-62995-authlib-joserfc-token-malleability-via-trailing-padding)
- [PYSEC-2026-2529 - joserfc's PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)](https://junglewise.ai/threats/cve-2026-27932-joserfc-s-pbes2-p2c-unbounded-iteration-count-enables-denial-of)