Threats tagged 'brew-fastmcp-cve-2025-68158'

Authlib versions from 2.12.3 up to but not including 2.14.1 have a vulnerability in cache-backed state storage used during OAuth flows. The state parameter used for CSRF protection is not tied to the initiating user session, allowing an attacker to perform a login CSRF attack. This can lead to account takeover if the application links accounts upon login callbacks. The vulnerability is fixed in version 2.14.1.