Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

影響: pip:authlib >= 1.3.1, <= 1.8.0 → 1.9.0

OctKey.import_key() carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is raw_key.startswith(POSSIBLE_UNSAFE_KEYS) — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path (cryptography.hazmat.primitives.serialization.load_pem_public_key / load_pem_x509_certificate) skips anything before the -----BEGIN line. A PEM public key or X.509 certificate carrying one leading byte — a newline, a…

在 GitHub Advisory Database 阅读

2026/10/28 00:38，GitHub Advisory Database 发布了“Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-114615。