Threats tagged 'brew-kimi-cli-cve-2026-28802'

A vulnerability in the kimi-cli's Authlib library versions 1.5.1-1, 1.5.2-1, 1.6.0-1, and versions from 1.6.5 up to but not including 1.6.7 allows bypassing JWT signature verification when the token uses the 'alg: none' algorithm with an empty signature. This flaw enables acceptance of forged JWTs without proper signature validation, potentially leading to authentication bypass and unauthorized access. The issue was introduced in the upgrade from version 1.5.2 to 1.6.0 and persists in later affected versions. A patch is available to address this vulnerability.