Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
影響: pip:authlib >= 1.3.1, <= 1.8.0 → 1.9.0
OctKey.import_key() carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is raw_key.startswith(POSSIBLE_UNSAFE_KEYS) — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path (cryptography.hazmat.primitives.serialization.load_pem_public_key / load_pem_x509_certificate) skips anything before the -----BEGIN line. A PEM public key or X.509 certificate carrying one leading byte — a newline, a…
| CVE | CVE-2026-114615 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 12:38, GitHub Advisory Database에서 "Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python. CVE: CVE-2026-114615.