Authlib versions prior to 1.9.1 contain a critical vulnerability in the OctKey.import_key() and HMAC signing and verification path that allows zero-length key material. This flaw permits a remote attacker to generate valid HS256, HS384, or HS512 signatures for arbitrary token claims if the application's secret lookup returns an empty string or empty bytes. The vulnerability is fixed in Authlib version 1.9.1.