{"id":"ghsa-ghsa-7vr2-2fgp-9w7p","seq":1708782,"kind":"advisory","title":"Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys","url":"https://github.com/advisories/GHSA-7vr2-2fgp-9w7p","permalink":"https://vulnpulse.app/items/ghsa-ghsa-7vr2-2fgp-9w7p","summary":"影響: pip:authlib >= 1.3.1, <= 1.8.0 → 1.9.0\nOctKey.import_key() carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is raw_key.startswith(POSSIBLE_UNSAFE_KEYS) — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path (cryptography.hazmat.primitives.serialization.load_pem_public_key / load_pem_x509_certificate) skips anything before the -----BEGIN line. A PEM public key or X.509 certificate carrying one leading byte — a newline, a…","severity":"high","techs":["python"],"cves":["CVE-2026-114615"],"tags":["GHSA-7vr2-2fgp-9w7p","authlib"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:38:48.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}