Authlib CVE-2026-114615 and CVE-2026-114616: Who Can Forge Your Tokens and How to Fix It
Two Authlib flaws let an attacker forge valid JWTs when a secret is empty or a PEM key has a stray prefix. Who is exposed, how to find Authlib in your stack, and why 1.9.0 is not enough.













