Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

影響: pip:authlib >= 1.3.1, <= 1.8.0 → 1.9.0

OctKey.import_key() carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is raw_key.startswith(POSSIBLE_UNSAFE_KEYS) — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path (cryptography.hazmat.primitives.serialization.load_pem_public_key / load_pem_x509_certificate) skips anything before the -----BEGIN line. A PEM public key or X.509 certificate carrying one leading byte — a newline, a…

GitHub Advisory Databaseで読む

2026/10/28 00:38、GitHub Advisory Databaseが「Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python。CVE: CVE-2026-114615。