Threats tagged 'brew-kimi-cli-cve-2026-44681'

Authlib versions prior to 1.6.12 and 1.7.1 contain an unauthenticated open redirect vulnerability in the OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoints. This flaw is triggered by omitting the 'openid' scope in authorization requests, causing the server to redirect to an attacker-chosen URL without validating the redirect URI. The vulnerability affects servers supporting OpenID Connect Implicit or Hybrid flows and can be exploited without authentication or valid client IDs. While it does not directly leak tokens or authorization codes, it enables phishing attacks by leveraging the trusted authorization server's domain in the browser's URL bar. A fix is available for this vulnerability.