CVE-2026-114615 - Anchore Vulnerability Database

Provider	Severity	CVSS	Published	Modified
NVD	CRITICAL	N/A	2026-10-22	2026-10-29
CHAINGUARD	CRITICAL (4)	N/A	N/A	N/A
DEBIAN	CRITICAL (4)	N/A	N/A	N/A
ECHO	CRITICAL (1)	N/A	N/A	N/A
SLES	HIGH (6)	N/A	N/A	N/A
UBUNTU	MEDIUM (4)	N/A	N/A	N/A
WOLFI	CRITICAL (1)	N/A	N/A	N/A

CRITICAL

ID

CVE-2026-114615

Published

2026-10-22

Modified

2026-10-29

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.

CVSS Version	Base Score	Vector	Source
3.1	N/A	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`	NVD
3.1	N/A	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`	security-advisories@github.com

References (5)

CRITICAL (4)

ID

CVE-2026-114615

No description provided.

CVSS Version	Base Score	Vector	Source
3.1	N/A	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`	NVD

References (1)

https://images.chainguard.dev/security/CVE-2026-114615

Affected Packages (4)

Package	Namespace	Version Range	Fix State	Fix Version
airflow-3	chainguard	`< 3.3.2-r11`	fixed	3.3.2-r11
open-webui	chainguard	`< 0.12.3-r11`	fixed	0.12.3-r11
pgadmin4	chainguard	`< 9.18-r10`	fixed	9.18-r10
pgadmin4-fips	chainguard	`< 9.18-r11`	fixed	9.18-r11

CRITICAL (4)

ID

CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.

CVSS Version	Base Score	Vector	Source
3.1	N/A	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`	NVD

References (1)

https://security-tracker.debian.org/tracker/CVE-2026-114615

Affected Packages (4)

Package	Namespace	Version Range	Fix State	Fix Version
python-authlib	debian	`N/A`	not-fixed	N/A
python-authlib	debian	`N/A`	not-fixed	N/A
python-authlib	debian	`< 1.9.1-1`	fixed	1.9.1-1
python-authlib	debian	`< 1.9.1-1`	fixed	1.9.1-1

CRITICAL (1)

ID

CVE-2026-114615

No description provided.

CVSS Version	Base Score	Vector	Source
3.1	N/A	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`	NVD

References (1)

https://www.cve.org/CVERecord?id=CVE-2026-114615

Affected Packages (1)

Package	Namespace	Version Range	Fix State	Fix Version
python-authlib	echo	`N/A`	not-fixed	N/A

HIGH (6)

ID

CVE-2026-114615

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0.

CVSS Version	Base Score	Vector	Source
3.1	N/A	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`	Unknown

References (1)

https://www.suse.com/security/cve/CVE-2026-114615

Affected Packages (6)

Package	Namespace	Version Range	Fix State	Fix Version
python-authlib	sles	`N/A`	not-fixed	N/A
python311-Authlib	sles	`N/A`	not-fixed	N/A
python-authlib	sles	`N/A`	not-fixed	N/A
python311-Authlib	sles	`N/A`	not-fixed	N/A
python-authlib	sles	`N/A`	not-fixed	N/A
python311-Authlib	sles	`N/A`	not-fixed	N/A

MEDIUM (4)

ID

CVE-2026-114615

No description provided.

References (1)

https://ubuntu.com/security/CVE-2026-114615

Affected Packages (4)

Package	Namespace	Version Range	Fix State	Fix Version
python-authlib	ubuntu	`N/A`	wont-fix	N/A
python-authlib	ubuntu	`N/A`	wont-fix	N/A
python-authlib	ubuntu	`N/A`	wont-fix	N/A
python-authlib	ubuntu	`N/A`	not-fixed	N/A

CRITICAL (1)

ID

CVE-2026-114615

No description provided.

CVSS Version	Base Score	Vector	Source
3.1	N/A	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`	NVD

References (1)

https://images.chainguard.dev/security/CVE-2026-114615

Affected Packages (1)

Package	Namespace	Version Range	Fix State	Fix Version
open-webui	wolfi	`< 0.12.3-r11`	fixed	0.12.3-r11

Anchore Vulnerability Database

Provider Summary

CVE-2026-114615CRITICAL

Exploit Prediction Scoring System (EPSS)

Package Lookup

Provider: NVD

CVSS Scores

Provider: CHAINGUARD

CVSS Scores

Provider: DEBIAN

CVSS Scores

Provider: ECHO

CVSS Scores

Provider: SLES

CVSS Scores

Provider: UBUNTU

Provider: WOLFI

CVSS Scores