The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches server-chosen $ref URLs during tool output schema validation. This causes the client to synchronously request external HTTP, HTTPS, or local file URLs on every tool call, potentially stalling the client if the target is unresponsive. The issue is fixed in versions 1.30.0 and 2.2.0 or later by restricting reference resolution to within the schema document only.
The Model Context Protocol (MCP) Python SDK versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1 improperly followed HTTP redirects across origins while carrying custom headers and, on certain redirects, the request body. This behavior could expose sensitive headers such as API keys to unintended hosts if the trusted endpoint redirects to a different origin. The SDK's OAuth client providers were similarly affected. The issue is fixed in MCP versions 1.30.0 and 2.2.0, which restrict redirects to the same origin or scheme upgrades on the same host. No code changes are needed to apply the fix.
Authlib's RFC 9101 (JAR) extension contains an SSRF vulnerability due to unvalidated use of the attacker-controlled request_uri parameter in a pre-authentication context. The extension forwards the request_uri to a fetch hook without enforcing the existing allowlist or other recommended controls, enabling unauthenticated SSRF. This affects versions from 0.11.11 up to but not including 0.23.1_2. A fix is available in version 0.23.1_2.
Authlib's OpenID Connect implicit grant implementation contains a vulnerability where the raw scope parameter from the client request is checked instead of the filtered allowed scope before issuing ID tokens. This allows a registered OAuth client that is not permitted the 'openid' scope but allowed other scopes like 'profile' to obtain signed ID tokens if the user consents. The issue affects deployments using the OpenID implicit grant and clients permitted 'id_token' response types but excluded from the 'openid' scope. The vulnerability does not affect authorization code flow deployments or setups where clients allowed 'id_token' response types are also allowed the 'openid' scope.
Authlib's default implementation of the RFC 7523 JWT bearer grant does not properly validate the 'aud' (audience) claim in JWT assertions. Instead of verifying that the 'aud' claim matches the authorization server's token endpoint, it only checks for the presence of the claim. This allows an attacker with a valid JWT for one audience to use it to obtain access tokens from a different authorization server sharing the same signing key, effectively bypassing audience restrictions.
Authlib versions prior to 0.23.1_2 contain a vulnerability in the OpenID ID token parsing logic where the nonce validation can be bypassed if the ID token includes a nonce_supported claim set to boolean false. This causes the nonce check to be skipped, allowing replay of a valid signed ID token into an attacker-controlled session, authenticating the attacker as the victim. The issue affects implicit and hybrid flows and direct calls to parse_id_token(), but not the authorization code flow. A fix is available in version 0.23.1_2.
Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT HS256/HS384/HS512 signature verification, allowing attackers to forge tokens that pass signature checks. This occurs because empty keys produce deterministic digests that anyone can reproduce, enabling token forgery and authentication bypass in OAuth 2.0 and OIDC implementations using Authlib. The vulnerability is confirmed in the v1.7.2 release and remains in the current main branch. A fix is available in version 0.23.1_2.
A vulnerability in the Authlib library (CVE-2026-114615) allows an attacker to forge HMAC signatures by exploiting an incomplete fix for algorithm confusion. The issue arises because the check preventing asymmetric public keys from being used as HMAC secrets only inspects the start of the key bytes. If the PEM public key or X.509 certificate includes a leading byte such as a newline, space, or UTF-8 BOM before the '-----BEGIN' marker, the check is bypassed, allowing an attacker with only the public key to create a valid HS256 token with arbitrary claims. This flaw affects versions >=0.11.11 and <0.23.1_2 of the mcp-atlassian Authlib package and has been fixed in version 0.23.1_2.
Authlib versions from 0.13 through 1.7.2 contain a vulnerability in the is_secure_transport() function where the loopback exemption for HTTP URLs can be bypassed by including a userinfo component in the URL. This causes the function to incorrectly treat certain cleartext HTTP URLs with non-loopback hosts as secure, violating OAuth 2.0 / OIDC TLS requirements. The flaw affects validation of redirect URIs and authorization server metadata endpoints, potentially allowing an attacker to register or use insecure URLs that bypass TLS enforcement. The severity is low and a fix is available in version 0.23.1_1.
A vulnerability in dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade application performance or lead to denial of service (DoS) in applications that handle untrusted DNS wire format messages. The issue is fixed in dnspython version 0.23.1_2. No workarounds are currently known.
A vulnerability in setuptools on Windows allows an attacker to craft a wheel file with a specially crafted namespace_packages.txt that causes setuptools to create an __init__.py file outside the intended installation directory. This file is created at an attacker-influenced absolute path with fixed content and the permissions of the installing process. The issue arises because the path in namespace_packages.txt is not validated and can be interpreted as an absolute Windows path, leading to directory escape during legacy wheel installation.
Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This method incorrectly accepts JSON Serialization JWS objects with an empty signatures array as valid without verifying any signature or requiring a cryptographic key. This flaw allows an attacker to forge payloads that are accepted as authenticated by any relying party using this method on untrusted input.
Multiple security vulnerabilities affecting Apache Tomcat in Red Hat Enterprise Linux 10.0 Extended Update Support have been addressed. These include security constraint bypass, access control bypass due to an off-by-one error, improper authentication, authentication bypass via replay attack, unauthorized resource access via FORM authentication bypass, and denial of service via HTTP/2 allocation leak. A bug fix for stalled TLS handshake issues is also included. The update is rated as important by Red Hat Product Security.