Threats tagged 'brew-omnara-cve-2026-114616'

Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT signature verification using HS256, HS384, and HS512 algorithms. This allows attackers to forge tokens with arbitrary claims that pass signature verification if the application verifies tokens with an empty key. The vulnerability arises because the library does not reject zero-length keys, resulting in a deterministic HMAC digest that anyone can reproduce. This issue affects OAuth 2.0 resource servers and OIDC relying parties using Authlib for token verification.