Threats affecting pkg:brew/omnara

The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 validate tool output schemas by fetching external $ref URLs, including http, https, and file URLs, from the client's network position. This can cause the client to make unintended network or local file requests and stall if the remote endpoint is unresponsive. The issue affects clients calling tools on servers they do not fully control.

The Model Context Protocol (MCP) Python SDK versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where their HTTP client transports follow cross-origin HTTP redirects, sending custom headers and, on 307/308 redirects, the request body to the redirected host. This can expose sensitive headers such as X-API-Key to unintended origins if an attacker can cause a trusted endpoint to redirect to a malicious host. The Authorization bearer header is not exposed due to existing HTTP library protections. The issue affects SDK clients using HTTP with follow_redirects enabled. Fixed in versions 1.30.0 and 2.2.0, the SDK now restricts redirects to the same origin or http to https upgrades on the same host, failing otherwise.

Authlib's implementation of the RFC 9101 JWT-secured authorization request (JAR) extension allows an unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the unvalidated request_uri parameter. The extension passes the attacker-controlled request_uri directly to a fetch hook without validating against the existing allowlist or performing recommended checks such as media type validation or timeouts. This flaw exists in Authlib version 1.7.2 and the current main branch. The vulnerability arises because the documented example implementation encourages an insecure fetch method that blindly performs HTTP GET requests on attacker-controlled URIs before any authentication occurs.

Authlib's OpenID Connect implicit grant implementation contains a vulnerability where the authorization request validation checks the raw client-supplied scope instead of the filtered allowed scope before issuing ID tokens. This allows a registered OAuth client, which is not permitted the 'openid' scope but allowed other scopes like 'profile', to receive a signed ID token if the user consents. The issue affects deployments using the OpenIDImplicitGrant and clients permitted 'id_token' response types without the 'openid' scope. The vulnerability does not affect authorization code flow deployments or those where clients with 'id_token' response types are also allowed the 'openid' scope.

Authlib versions from 0.13 through 1.7.2 contain a vulnerability in the is_secure_transport() function, which incorrectly treats certain HTTP URLs with userinfo components as secure loopback addresses. This flaw allows an attacker to bypass the TLS enforcement by crafting URLs like http://localhost:80@evil.example/cb, which appear to be loopback HTTP URLs but actually point to external hosts over cleartext HTTP. The vulnerability affects OAuth 2.0 / OIDC endpoint and redirect URI validations, potentially allowing cleartext non-loopback URLs to pass security checks.

A vulnerability in dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade application performance or cause denial of service (DoS) in applications that handle untrusted DNS wire format messages using dnspython. The issue is fixed in dnspython version 2.9.0. No known workarounds exist.

Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty signatures array, which the method incorrectly accepts as valid without verifying any signature or requiring a cryptographic key. This results in an attacker-authored payload being accepted as authenticated, enabling a complete authentication bypass when identity or authorization claims are involved.

Authlib's default implementation of the RFC 7523 JWT bearer grant does not properly validate the audience ('aud') claim in JWT assertions. Instead of verifying that the 'aud' claim matches the authorization server's token endpoint, it only checks for the presence of the claim. This allows an attacker with a valid JWT for any audience to use it against a different authorization server sharing the same signing key to obtain an access token improperly.

Authlib versions including 1.8.0 contain a vulnerability in the OpenID ID token validation process where the nonce validation can be disabled by an ID token carrying a boolean false nonce_supported claim. This allows an attacker to replay a validly signed ID token from a victim into an attacker-controlled session, bypassing nonce checks and authenticating as the victim. The flaw affects implicit and hybrid OpenID flows and applications calling parse_id_token() directly. Authorization code flow is not affected. No fixed versions are currently available.

Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT signature verification using HS256, HS384, and HS512 algorithms. This allows attackers to forge tokens with arbitrary claims that pass signature verification if the application verifies tokens with an empty key. The vulnerability arises because the library does not reject zero-length keys, resulting in a deterministic HMAC digest that anyone can reproduce. This issue affects OAuth 2.0 resource servers and OIDC relying parties using Authlib for token verification.

CVE-2026-114615 is a vulnerability in Omnara's authlib library where an incomplete fix for algorithm confusion allows an attacker to forge HMAC tokens using asymmetric public keys with certain leading bytes. The guard that prevents using asymmetric keys as HMAC secrets only checks if the key bytes start exactly with known PEM headers, but the loader accepts keys with leading whitespace, newlines, or comments. This discrepancy enables an attacker with only the issuer's public key to create HS256 tokens that the system accepts as authentic. The issue affects versions 1.5.2 and later, including the latest 1.8.0 release as of 2026-08-30.

A vulnerability in the AIOHTTP library allows the Secure attribute of shared cookies to not be enforced. This means a cookie marked as Secure could be transmitted over unencrypted HTTP connections, potentially exposing it to interception.

A critical vulnerability (CVE-2026-32871) exists in Omnara's FastMCP OpenAPI Provider where path parameters are substituted into URL templates without URL encoding. This allows an attacker to inject path traversal sequences (e.g., '../') that are resolved by urljoin(), enabling authenticated Server-Side Request Forgery (SSRF) to access arbitrary backend endpoints with the MCP provider's authorization context.

Authlib's JWS implementation contains a JWK header injection vulnerability (CVE-2026-27962) that allows an attacker to forge JWT tokens that pass signature verification. When the deserialization function is called with key=None or when a key resolver returns None, the library uses the attacker-controlled 'jwk' header as the verification key, violating RFC 7515. This enables authentication and authorization bypass by accepting forged tokens with arbitrary claims.