PYSEC-2026-4356: Authlib accepts zero-length HMAC key material

Before version 1.9.1, Authlib's OctKey.import_key() and HMAC signing and verification path accept zero-length key material. If an application's secret lookup can return an empty string or empty bytes, an attacker can create valid HS256, HS384, or HS512 signatures for arbitrary token claims and have Authlib treat the tokens as authentic. The source describes the attack class and does not confirm exploitation in a live system.