Threats tagged 'brew-fastmcp-cve-2026-114614'

Authlib's is_secure_transport() function incorrectly treats URLs with a userinfo component containing loopback prefixes as secure, allowing cleartext HTTP URLs with external hosts to bypass TLS enforcement. This affects OAuth 2.0 / OIDC endpoint and redirect URI validation, potentially allowing attackers to register or use non-TLS URLs that should be rejected. The issue is present in Authlib versions from 0.13 through 1.7.2 and fixed in version 4.0.0. The vulnerability is considered low severity due to its defense-in-depth nature and limited impact.