{
  "cveId": "CVE-2026-114616",
  "url": "https://patchblox.com/security/cve/CVE-2026-114616",
  "summary": "CVE-2026-114616 is fixed in python-authlib on 1 platform by DEBIAN-CVE-2026-114616 (version 1.9.1-1), released October 31, 2026. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "python-authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers",
  "description": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.1, Authlib\u0027s OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application\u0027s secret lookup can return an empty string or empty bytes, a remote attacker can compute the deterministic HS256, HS384, or HS512 signature for arbitrary token claims and have Authlib treat the token as authentic. This issue is fixed in version 1.9.1.",
  "published": "2026-10-22T22:18:04Z",
  "severity": "critical",
  "cvss": 9.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss": 0.00299,
  "epssPercentile": 0.22732,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-authlib",
      "release": "Debian 14",
      "fixedVersion": "1.9.1-1",
      "fix": "DEBIAN-CVE-2026-114616",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-114616",
      "released": "2026-10-31T22:18:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T01:44:33Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}