Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: authlib/joserfc
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 1.6.7
Choose a base ref
...
head repository: authlib/joserfc
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 1.6.8
Choose a head ref
  • 2 commits
  • 6 files changed
  • 2 contributors

Commits on May 27, 2026

  1. Reject empty oct key material and empty HMAC keys at sign/verify entry 

    An empty oct key produces a deterministic HMAC digest reproducible by any
party, so accepting one in JWS verification lets an attacker forge HS256/
HS384/HS512 signatures with no secret knowledge. The path is reached
whenever the application's secret resolves to "" or None (unset env var,
missing config row, key finder fallback). Promote the existing
SecurityWarning for keys smaller than 14 bytes to a hard reject at
length == 0 inside OctKey.import_key, and add a defence-in-depth check in
HMACAlgorithm.sign / .verify after get_op_key so OctKey instances
constructed through non-import paths are also rejected. Add regression
tests in test_oct_key.py (import-side) and test_compact.py (HMAC-side).

Cross-language sibling of jwt/ruby-jwt CVE-2026-45363 / GHSA-c32j-vqhx-rx3x
fix in lib/jwt/jwa/hmac.rb. Equivalent guards already exist in PyJWT 2.13.0,
firebase/php-jwt, jjwt (256-bit minimum), and Microsoft IdentityModel
(128-bit minimum).

Signed-off-by: tonghuaroot <[email protected]>
    @tonghuaroot @lepture
    tonghuaroot authored and lepture committed May 27, 2026
    Configuration menu
    Copy the full SHA
    86d0091 View commit details
    Browse the repository at this point in the history

  2. chore: release 1.6.8

    @lepture
    lepture committed May 27, 2026
    Configuration menu
    Copy the full SHA
    ea1d9e3 View commit details
    Browse the repository at this point in the history
Loading