Threats tagged 'pysec-2026-4355'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.4	EPSS 0.2%	CVE-2026-114615From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM High7.4EPSS 0.2%2026-10-22GCVE DatabaseCVE-2026-114615 Authlib versions from 1.3.1 up to but not including 1.9.0 contain a vulnerability in the OctKey.import_key() function. The function only checks asymmetric-key markers at the first byte, while PEM loaders accept leading whitespace, comments, or byte-order marks. This discrepancy allows an attacker who knows the public key bytes with such prefixes to use them as an HMAC secret and forge HS256 tokens with arbitrary claims. This vulnerability bypasses the remediation for CVE-2024-37568 and is fixed in version 1.9.0. EPSS 0.2%Report on CVE-2026-114615 Vulnerability #pysec-2026-4355 #pypi	GCVE Database	2026-10-22

Page 1 of 1