Threats tagged 'brew-mcp-atlassian-cve-2026-114614'

Authlib versions from 0.13 through 1.7.2 contain a vulnerability in the is_secure_transport() function where the loopback exemption for HTTP URLs can be bypassed by including a userinfo component in the URL. This causes the function to incorrectly treat certain cleartext HTTP URLs with non-loopback hosts as secure, violating OAuth 2.0 / OIDC TLS requirements. The flaw affects validation of redirect URIs and authorization server metadata endpoints, potentially allowing an attacker to register or use insecure URLs that bypass TLS enforcement. The severity is low and a fix is available in version 0.23.1_1.