Threats tagged 'brew-mcp-atlassian-cve-2026-114615'

A vulnerability in the Authlib library (CVE-2026-114615) allows an attacker to forge HMAC signatures by exploiting an incomplete fix for algorithm confusion. The issue arises because the check preventing asymmetric public keys from being used as HMAC secrets only inspects the start of the key bytes. If the PEM public key or X.509 certificate includes a leading byte such as a newline, space, or UTF-8 BOM before the '-----BEGIN' marker, the check is bypassed, allowing an attacker with only the public key to create a valid HS256 token with arbitrary claims. This flaw affects versions >=0.11.11 and <0.23.1_2 of the mcp-atlassian Authlib package and has been fixed in version 0.23.1_2.